use SecureRandom instead of Random
Merge pull request #3805 from mesutcelik/secureRandomFix

[backport] Session ID must use cryptographically strong random number generator