Always use an alphabet in util.random_string()
Always use an alphabet in util.random_string()

Previously, `random_string()` returned 16 random bytes from
`os.urandom()` encoded as a 32-char hex string by default (i.e., it
returned half as many random bytes/chars as would be expected).

Now it returns 32 random characters from the URL-safe base 64 alphabet
by default.

Comparing the number of old vs. new possibilities:

    >>> 256 ** 16
    340282366920938463463374607431768211456
    >>> 64 ** 32
    6277101735386680763835789423207666416102355444464034512896

Comparing bits of entropy:

    >>> int(math.log(256, 2)) * 16
    128
    >>> int(math.log(64, 2)) * 32
    192

I'm not sure the new way is truly more secure, but it's less confusing
and probably more in line with what would be expected from "random
string of 32 characters".

Caveat: I'm not a security professional, so this could all be totally
bogus.

TangledWeb/tangled