change to require securerandom