clarify that the new rand() isn't cryptographically secure

so people won't read too much into the change