Remove max parameter from util.random_string

The only place that uses it, trans-receiver-htmlfile.js, doesn't need it; it
prepends 'a' to the front of the identifier, so numbers aren't a problem. This
is a nuisance for making util.random_string use a real random number generator;
values of max that aren't powers of two would bias towards some values.

That caller doesn't really care anyway, but we may as well remove the
unnecessary parameter.
Use window.crypto.getRandomValues when available

Issue #56. New versions of Chrome, Firefox, and Safari provide access to
cryptographically random numbers. Change the length of random_string_chars to
be 32 so we don't introduce biases in taking the modulus.

Also make the code just index into the string, instead of doing things with
substr.
Merge pull request #128 from davidben/randomness

Use window.crypto.getRandomValues when available