hash tokens in database

implementation for discussion in #80

- add cookie_secret_file
- store cookie_secret on disk (or env or config file), instead of in database
- remove cookie tokens
- hash API tokens in database
- don't store proxy token in db (restarting Hub requires restarting proxy, unless token is stored in env or config)