replace utils.randombytes with os.urandom
diff --git a/requests/auth.py b/requests/auth.py
index e636b72402..cb851d2cde 100644
--- a/requests/auth.py
+++ b/requests/auth.py
@@ -7,13 +7,14 @@
 This module contains the authentication handlers for Requests.
 """
 
+import os
 import time
 import hashlib
 
 from base64 import b64encode
 
 from .compat import urlparse, str
-from .utils import randombytes, parse_dict_header
+from .utils import parse_dict_header
 
 try:
     from oauthlib.oauth1.rfc5849 import (Client, SIGNATURE_HMAC, SIGNATURE_TYPE_AUTH_HEADER)
@@ -192,7 +193,7 @@ def sha_utf8(x):
                 s = str(nonce_count).encode('utf-8')
                 s += nonce.encode('utf-8')
                 s += time.ctime().encode('utf-8')
-                s += randombytes(8)
+                s += os.urandom(8)
 
                 cnonce = (hashlib.sha1(s).hexdigest()[:16])
                 noncebit = "%s:%s:%s:%s:%s" % (nonce, ncvalue, cnonce, qop, hash_utf8(A2))
diff --git a/requests/sessions.py b/requests/sessions.py
index dd670dd33e..aa90ecc7cd 100644
--- a/requests/sessions.py
+++ b/requests/sessions.py
@@ -9,6 +9,7 @@
 
 """
 
+from copy import deepcopy
 from .compat import cookielib
 from .cookies import cookiejar_from_dict, remove_cookie_by_name
 from .defaults import defaults
@@ -81,7 +82,7 @@ def __init__(self,
         self.cert = cert
 
         for (k, v) in list(defaults.items()):
-            self.config.setdefault(k, v)
+            self.config.setdefault(k, deepcopy(v))
 
         self.init_poolmanager()
 
diff --git a/requests/utils.py b/requests/utils.py
index 8365cc3699..e60b9c48e2 100644
--- a/requests/utils.py
+++ b/requests/utils.py
@@ -12,14 +12,12 @@
 import cgi
 import codecs
 import os
-import random
 import re
 import zlib
 from netrc import netrc, NetrcParseError
 
 from .compat import parse_http_list as _parse_list_header
-from .compat import quote, is_py2, urlparse
-from .compat import basestring, bytes, str
+from .compat import quote, urlparse, basestring, bytes, str
 from .cookies import RequestsCookieJar, cookiejar_from_dict
 
 _hush_pyflakes = (RequestsCookieJar,)
@@ -248,15 +246,6 @@ def header_expand(headers):
     return ''.join(collector)
 
 
-def randombytes(n):
-    """Return n random bytes."""
-    if is_py2:
-        L = [chr(random.randrange(0, 256)) for i in range(n)]
-    else:
-        L = [chr(random.randrange(0, 256)).encode('utf-8') for i in range(n)]
-    return b"".join(L)
-
-
 def dict_from_cookiejar(cj):
     """Returns a key/value dictionary from a CookieJar.
 

My understanding is that Python's `random` module is not recommended for cryptographic use. `os.urandom` should provide random bytes on all major platforms: Linux, OS X, *nix, and Windows:

http://docs.python.org/library/os.html#os.urandom
http://docs.python.org/release/3.0.1/library/os.html#os.urandom

Since the function provides a `str` under 2.x and a `bytes` under 3.x, and the result is fed directly into SHA, there shouldn't be an issue with the encoding.

Thoughts? Thanks for your time.
