Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
It's OK not to add it if we don't want to allow generating 1 character keys.