Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
I don't get it. Do you mean some special `$length` may require this? I think a line of comment is needed if there is a special reason for this.