new randomString function should take len arg
convert over to server-side crypto
Merge pull request #2060 from rhelmer/bug844796-session-token-generation

Bug844796 session token generation