[WIP] Remove tokens from Database

Alternative implementation of #81 for discussion in #80.

Removes the APIToken and CookieToken fields from the ORM in favor of relying on Tornado's cookie encryption as the source
of truth for authentication.

This is currently rebased off of @minrk's work on https://github.com/jupyter/jupyterhub/pull/81 to steal his refactoring of the cookie_secret and proxy auth token handling.  If we decide to go this route, it should be rebased some more to not include the detour through DIY encryption-land.
Also, for my own ref while reviewing, [a security stackexhange post with some discussion of HMAC and PBKDF2](http://security.stackexchange.com/questions/13590/hmac-pbkdf2-vs-simple-hashing-algorithm-for-web-service-authentication).