webconfig: Use a constant-time token comparison

This prevents a linear-time attack to recover the auth token.
webconfig: Use 16 byte tokens, as advertized
webconfig: Get the auth token from os.urandom

random.getrandbits shouldn't be used for security.