Ensure that all generated session IDs are cryptographically strong.

We used to call RAND_pseudo_bytes, which will generate cryptographically
strong random bytes in most cases. Under memory pressure or other error
conditions, it can return weak random bytes.

It is unlikely that there is a way for an attacker to set up a condition
where the user is sucessfully logged in but receives a weak session
identifier, but to be safe, we switch to RAND_bytes.