vici: Don't use a default rand_time larger than half of rekey/reauth_time