`crypto.getRandomValues` gracefully falls back to `Math.random`