It's worth noting that reading /dev/urandom isn't exactly cheap.

Probably fine for generating session IDs in most circumstances, but if you're using it in another situation (e.g. shuffling something), you might find the performance is terrible.