access_token: use os.urandom to generate token

Using same method as python 3.6's secrets module.