code: private void initRandom() {
          try {
              random = new SecureRandom();
          } catch (Exception e) {
              log.warn("Could not generate SecureRandom for session-id randomness", e);
              random = new Random();
              weakRandom = true;
          }
      }
docs: Set up a random number generator for the sessionids.
  
  By preference, use a SecureRandom but allow to be injected.