WebStyle: new config option CFG_SITE_SECRET_KEY

* Adds CFG_SITE_SECRET_KEY to set the Flask config variable
  SECRET_KEY on a per-site base. The variable should be used to
  e.g. protect against cross-site request forgery.

Reviewed-by: Jiri Kuncar <jiri.kuncar@cern.ch>
WebStyle: check empty variable CFG_SITE_SECRET_KEY
WTForms: config option CFG_SITE_SECRET_KEY usage

* Uses CFG_SITE_SECRET_KEY as SECRET_KEY in SessionSecureForm.
WebStyle: catch HTTPS redirects in debug toolbar

* Move loading of Flask Debug Toolbar just before SSLify to
  catch HTTPS redirects.

* FIXME flask_sslify should work in debug mode as well. (see #1325)

Co-authored-by: Jiri Kuncar <jiri.kuncar@cern.ch>
inveniocfg: --create-secret-key addition
WebStyle: fix redirects from mp_legacy_publisher

* Uses same exception code handling for invenio_handler and
  mp_legacy_publisher. (closes #1335)

Reported-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
WebSearch: fix access to restricted records

* Adds check if user can see the record before any '/record' page is
  displayed.  (closes: #1340)

* Adds method `is_super_admin` to check if `current_user` is super
  admin.

Reported-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
WebSession: cache decorator removal on logout

* Fixes logout when "Remember me" feature has been checked
  and CFG_DEVEL_SITE = 0.  (closes #1339)

Reported-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
installation: info about creation of secret key
WebStyle: fix response status code

* Fixes setter and getter of SimulatedModPythonRequest status property
  that it uses Flask response instance.  (closes #1328)

Reported-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
installation: empty CFG_SITE_SECRET_KEY checker

Tested-by: Tibor Simko <tibor.simko@cern.ch>