I forget now whether I did it server-side or client-side but I do generate a random hex string, yes.

It's reassuring to hear that a former Google engineer shares my same suspicions as to why this happened. Thank you.