Provide CSPRNG to HTTP handlers

HTTP handlers have side-effects, so they don't have replayability requirement of reducers.

It would be nice to have a CSPRNG available to HTTP handers, so they could e.g. mint JWT tokens for bridging from other authentication systems.