senchalabs/connect — pull request #453 by cweider (2012-01-09 10:14:33+00:00)
Title: The utils.uid is used as a nonce; it should be secure.

```
% grep -r uid lib
lib/middleware/csrf.js: var token = req.session._csrf || (req.session._csrf = utils.uid(24));
lib/middleware/session.js: req.sessionID = utils.uid(24);
````