[backport] Session ID must use cryptographically strong random number generator