Use strlen(). Comparing a string against a length will not do the rig…

…ht thing.

lib/Cake/Utility/Security.php

@@ -191,7 +191,7 @@ public static function randomBytes($length) {
 			E_USER_WARNING
 		);
 		$bytes = '';
-		while ($bytes < $length) {
+		while (strlen($bytes) < $length) {
 			$bytes .= static::hash(CakeText::uuid() . uniqid(mt_rand(), true), 'sha512', true);
 		}
 		return substr($bytes, 0, $length);