REST DefaultSessionManager uses weak random

It looks like sessions are created in com.atlassian.bamboo.rest using Bamboo's own Random package which calls Java's random instead of Atlassian secure random https://extranet.atlassian.com/display/DEV/Using+atlassian-secure-random

Please replace.