Implement and document how safe_nonce() values are generated.