Crank up that saltiness -- thanks @Plazmaz! (Note: This only affects …

…apps which explicitly do not provide their own session secret. In production, this is always accompanied by a warning message regardless.)

lib/hooks/session/generateSecret.js

@@ -14,7 +14,7 @@ module.exports = function generateSecret() {
   // Combine random and case-specific factors into a base string
   var factors = {
     creationDate: (new Date()).getTime(),
-    random: Math.random() * (Math.random() * 1000),
+    random: crypto.randomBytes(64).toString('hex'),
     nodeVersion: process.version
   };
   var basestring = '';