Ensure randomness does not cause failure

- Previously numbers can be too small, resulting in an odd number of hex
  digits resulting in encoding failure.  Also it can result in too small
  of a random string.
- This ensures we have the proper length and no random failures.
A user is not guaranteeed to be returned

- There are cases where the access token may return no users, which can
  be caused by a deleted user that happens to be logged in.
Probably not a bad idea to ensure testability.

- Made the random string generation in csrf testable.
Cripes silently failing again here too.