Entropy requirements

The current text around guessing isn't quite right for a couple of reasons.  Here's what I've done.

1. I've made the guessability thing a MUST rather than a weak SHOULD.  If you care about using these URIs as access control mechanisms, you have to have entropy.
2. A random number is not the only way to create a capability URL.  You can also use crypto.  It's probably not worth going into the details, particularly since there isn't a really good reference that describes how to do it properly ([this](https://tools.ietf.org/html/draft-rescorla-stateless-tokens-01) would be OK if were more stable).
3. I've removed the advice against roll-your-own random number generation and replaced that with a reference to RFC 4086, which is a very good primer on randomness for security.
4. I've recommended a minimum level of entropy.  A system that is able to limit guesses in some fashion might be able to use a lower entropy value, but it's not always easy to know that it is safe to do so.  For instance, if you have a large enough population of valid values, limiting guesses might not be enough.  As general guidance, I consider it best to be a little conservative.

(This builds on #4, so you might be better served just looking at the last commit.  If you don't like the whitespace changes, feel free to cherry-pick.)