Non-cryptographic secure random number generation for tokens #1

The SessionID is generated using rand::thread_rng() which is not cryptographic secure. This means that the effective bits a hacker needs to guess is significantly lower than you would expect based on the string. An attack vector is to create a few sessions and look for patterns. Based on these sessions, an attacker is likely to guess different session IDs.

I would advice using rand::OsRng or ring::rand::SystemRandom(). Both generators can generate cryptographic secure random strings.

Thanks, I don't think it's that critical but it's fixed in 0.2.1 I just released, using OsRng.