Most secure way to generate a random session ID for a cookie?
I would avoid the random factor completely. What I've generally done is:

Generate a sequential session_id (which I store locally).
When the user logs in, sign session_id with a private key (I use itsdangerous for this).
When I get a request, if the session_id's signature is intact, I proceed, otherwise, 403 (400 would make sense too).

Note that I store the session_id locally because I want to be able to expire end sessions prematurely.
If your sessions always last a fixed amount of time, and you don't need to end them prematurely, you can simply sign user_id + datetime.now(). This allows completely stateless session management.
I'm writing my own sessions controller that issues a unique id to a user once logged in, and then verifies and authenticates that unique id at every page load.  What is the most secure way to generate such an id?  Should the unique id be completely random?  Is there any downside to including the user id as part of the unique id?