fix biased secureRand()