for security, don't generate random numbers in the local game state

[andrewljohnson]

see: https://github.com/lacker/cardkit/blob/master/js/gamestate.js#L336