code: protected synchronized Random getRandom() {
          if (this.random == null) {
              try {
                  Class clazz = Class.forName(randomClass);
                  this.random = (Random) clazz.newInstance();
                  long seed = System.currentTimeMillis();
                  char[] entropy = getEntropy().toCharArray();
                  for (int i = 0; i < entropy.length; i++) {
                      long update = ((byte) entropy[i]) << ((i % 8) * 8);
                      seed ^= update;
                  }
                  this.random.setSeed(seed);
              } catch (Exception e) {
                  this.random = new java.util.Random();
              }
          }
          return (this.random);
      }
docs: Return the random number generator instance we should use for generating session identifiers. If there is no such
  generator currently defined, construct and seed a new one.