Not using secure random, at least now, as using the couchrest ID as the code for unauthenticated ticket access.