array_rand does not use secure random