Replace java.util.Random with SecureRandom

This task is to replace java.util.Random with SecureRandom. As pointed out on the mailing list by lmccay, this is not really necessary from a security POV, but it doesn't hurt either. Also replacing the associated StringBuffers with StringBuilders in this patch, as well as another minor change to avoid casting.