Revise default tokenhosts setup

The new default is that the hostname contained in the first assertion
sent to the server will be accepted, and it (and the corresponding IP
address, if it is a domain name) will be added to tokenhosts.

In addition, I have also added a better error message in the case of
an invalid token hostname, which should point users to the relevant
documentation.