Encrypted pk model

Try this one ;). It replaces the `token` field with encrypted ID which is unique and semi-random.

Currently, the encrypted ID contains `id` (as int64) + eight random bytes. After encryption, it looks totally random even though most of input were zeros ;). The random bytes guarantee changing output even with the same `id`, so — in the worst case — helps people not try to guess `SECRET_KEY` through guess-known `id`.

I'm wondering, though, if we shouldn't add some small checksum to this. Currently giving wrong token results in some awesomely random id in the output (often `OverflowError`). Maybe we should sacrifice two or four bytes to instead give straight `ValueError`.