webconfig: Use a constant-time token comparison

This prevents a linear-time attack to recover the auth token.
webconfig: fixes for token security

 * Use 16-byte tokens
 * Use os.urandom (random.getrandbits shouldn't be used for security)
 * Convert to hex correctly