Use a cryptographically secure pseudorandom number generator

Squashed all of the commits into a single commit.

See also: #128, #130
Should be `bin2hex($buf)`, and better to write `return $raw ? $buf : bin2hex($buf);` to avoid too many nested statement.