database security

- add files for cookie and database secrets
- store cookie secret on disk, instead of in database
- encrypt auth tokens with EncryptedType
only store hashed tokens

- use PasswordType
- store first 4 bytes for filtering by prefix
  since we can't filter by equality on the hashed value.
- user.new_foo_token() returns token string, not ORM object
remove API token from spawner state

it's not needed - new tokens are created when spawners start
Don't persist proxy auth token to db

removes last need for encrypted database fields, so db_secret is removed as well.
Don't need passlib + sqlalchemy_utils for hashing

we can store hash+salt ourselves.
Since we need to implement prefix filtering, etc. ourselves,
there is little benefit to adding a large dependency just for implicit hashing.
get rid of cookie tokens

use single cookie_id, since cookies themselves are already unique via `set_secure_cookie`

resetting cookie_id effectively logs out all browser sessions for a given user
use starts with when checking token prefix

allows prefix length to change
shorten interrupt timeout
add hash rounds

default 16k
Merge pull request #81 from minrk/crypto-db

hash tokens in database

closes #80
closes #83