Use one HMAC secret across wikis

When $wgSecretKey was used for HMACing the token secrets, other wikis
couldn't correctly calculate signatures, if they had a different secret.

Change-Id: Ia03d8c6ec2450afa67993431fe459eca39c8f2de