use sjcl random implementation instead of Math.random to generate passwords