server: more random for session id