Revert "Use ThreadLocalRandom in StringHelpers.randomString on Java 7."

ThreadLocalRandom turns out not to be a secure RNG, so using it compromises our
XSS and other protections for field names.

This reverts commit f2de993c8c568c994d4b2a04daf22b21f459b7bf.