Update main.js

Use a CSPRNG (`window.crypto.getRandomBytes`) to generate unbiased, random integers. This is far better than `Math.random()`.