use random() if we don't have arc4random()