[WIP] database security

implementation for discussion in #80

- add files for cookie and database secrets
- store cookie secrets on disk, instead of in database
- encrypt tokens in database (uses EncryptedType from SQLAlchemy-Utils)