Batch verification: Choose `z` in the range `[1..2^128)`.

[str4d]

It doesn't really matter whether we use the full field or not (as long as z != 0), but it makes various scalar mults cheaper.

Originally posted by @str4d in #59 (comment)