Use 128bit crypto-random secret in default session

Much more sane than what I was doing. I was aiming for 128bits to suit
the default sha512 algorithm, but actually only got 64 and I should have
definitely used a source of secure randomness.
Don't log the whole email in the notifier

That's just crazy noisy. If email logs are desirable, they should
be configured in the mail server.
Gunicorn sets logging from paste by default now

Since 19.1