only store hashed tokens

- use PasswordType
- store first 4 bytes for filtering by prefix
  since we can't filter by equality on the hashed value.
- user.new_foo_token() returns token string, not ORM object
remove API token from spawner state

it's not needed - new tokens are created when spawners start
Don't persist proxy auth token to db

removes last need for encrypted database fields, so db_secret is removed as well.