Looking at your PHP example, I was under the impression that random_bytes() was cryptographically secure nowadays, and already generated its pseudorandom sequen

Looking at your PHP example, I was under the impression that random_bytes() was cryptographically secure nowadays, and already generated its pseudorandom sequence non-deterministically? Can you help me understand why we need to surround the output of random_bytes() if it is already deemed cryptographically secure? EDIT: Sorry, I have mulled your solution over now and understand that the surrounding detail in the hash is to prevent one form's token being used in a different form. This makes sense, and doesn't imply that random_bytes is deterministic.