change the random policy.  use prng to not waste randomness

also, up to 16 bytes!
actually, 15 bytes is better