Update controller.php

HackerOne report 31171

Patch: If possible, use a CSPRNG for authentication.