Use shorter application references

Instead of obfuscating the ID, the token is now randomly generated and stored in the database.

* Length is currently set to 8, which gives about a trillion unique identifiers (32<sup>8</sup>).
* The same base 32 encoding is used as previously (0-9 and all letters except I, L, O, U to avoid ambiguity and profanity).
* The application reference is normalised and disambiguated on lookup (to avoid case mismatch or transcription errors).