when too many users logged in ,session_id may be the same, 

when too many users logged in ,session_id may be the same, so use SecureRandom.hex(32) instead of SecureRandom.hex(16)