salt generation is **not** secured

[docteurklein]

http://stackoverflow.com/a/2595372/244058

we shouldn't rely on rand(). better deprecate the notion of salt generation altogether and let bcrypt handle it better than us.