Shorter application references

This makes the application references shorter by removing the erroneous use of `to_s` before base 32 encoding. It also ensures that they are always seven digits long (with leading zeros where necessary) and hyphenates them in the format `XXX-XXXX`.

* Before: `64T3CDSN6CTKEDHM`
* After: `1BQ-HMCM`

Out of human kindness, it also:

* Ignores formatting (the presence or absence of hyphens or spaces)
* Is case-insensitive
* Permits ambiguous characters like O for 0 or I for 1

In addition, this introduces a different secret key for application reference obfuscation. This is done to ensure that sessions can be rolled (by changing `SECRET_KEY_BASE`) without breaking all saved applications. This requires a new environment variable, `APP_REF_SECRET_KEY` (attn @mattmb).
Why not use a real instance? You can still stub the method below, but we get the benefit of RSpec mocks exploding if someone later changes the name of/removes the obfuscate instance method.