generate session cookie using securerandom