Use mcrypt_create_iv or openssl_random_pseudo_bytes as random bytes source

Currently OAuth2 server uses `/dev/urandom` and fallbacks to `mt_rand()`.

`/dev/urandom` is good source of random data, however with `open_basedir` restriction in effect it throws warning. Suppressing it with `@` doesn't display warning, but error handler still gets called.

`mcrypt_create_iv` allows read bytes from `/dev/urandom` even with `open_basedir`, also supports Windows.

Based on Password Compat
https://github.com/ircmaxell/password_compat/blob/master/lib/password.php#L93