Use /dev/urandom properly, don't bother trying /dev/random first

See http://www.2uo.de/myths-about-urandom/ for details.

Also add clarifications in the few uses of the libc rand() - it looks
horribly insecure with no context but it's just a fallback.