Use SecureRandom instead of Random to generate the app secret

.. and use StringBuilder instead of StringBuffer (no synchronization needed).