let's use math/rand in tests (and not crypto/rand)