Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
I think we should 

* rename `generateRandomKey()` to `generateRandomBytes()`
* implement `generateRandomKey()` by adding an extra parameter representing the characters that can appear in the generated key. The length of the key must be the string length of the resulting key, not the original byte length (that is not usable in practice)