Use secure entropy source to generate CSRF tokens

[SmartHypercube]

Related issue: #1725

---

Before submitting your PR, check that you've:

• Bumped the version number
• Documented new APIs with Haddock markup
• Added @since declarations to the Haddocks for new, public APIs

After submitting your PR:

• Update the Changelog.md file with a link to your PR
• Check that CI passes (or if it fails, for reasons unrelated to your change, like CI timeouts)

[snoyberg]

Code looks OK to me, but I'm concerned about the major version bump.

[snoyberg]

Why is this a major version bump?

[SmartHypercube]

I'm not familiar with this version style. According to https://github.com/yesodweb/yesod/blob/master/CONTRIBUTING.md#versioning , I changed behavior of existing public API (yreGen is public), so I bumped B part. What version number do you think it should be? I'll change it.

[snoyberg]

I wouldn't consider this a semantic breaking change, but rather a bug fix. Either C or D would be appropriate here. I'd stick to a C bump, and would go for version 1.6.20. Thanks!

[snoyberg]

Thank you!