Use crypto.randomBytes() for token generation.
Updated crypto TODO to FIXME.