title: Most secure way to generate a random session ID for a cookie?
body: <p>I'm writing my own sessions controller that issues a unique id to a user once logged in, and then verifies and authenticates that unique id at every page load.  What is the most secure way to generate such an id?  Should the unique id be completely random?  Is there any downside to including the user id as part of the unique id?</p>