Fix issue #3: use os.urandom() for randomness