Use crypto.randomBytes as CSPRNG

As described in http://tools.ietf.org/html/rfc6238#section-5.1, you should rely on a cryptographically-secure random number generator that is what `crypto.randomBytes()` is.

`Math.random()` is not safe.