@samdark, first call tries to generate cryptographically strong random string. Second call is fallback to non-cryptographically strong random string generation. Second call would be performed in case cryptographically strong string cannot be generated in a particular environment.

I don't think we should move this fallback to `generateRandomString()` method. Better to generate what is actually requested and return `false` in case it cannot be done. What if user expects **ONLY** cryptographically safe string? I think he'll be surprised with non-crypto safe result while he requested something else.