Generate a random API key on initial setup (fixes #1118)

Also makes the javascript implementation use the same algorithm for generating random strings.

Uses a copy-pasted `randomString()` in the config package since the original variant isn't accessible from that package and doesn't make sense to move into the config package (also, it's 5 lines of code, so whatever...).