Use RNGCryptoServiceProvider to create true random session ids