Generate random token directly

This improves token generation in two ways:
- The use of HMAC doesn't appear to add any security. Normally, HMAC is used to sign some content, but in this case, the content being signed is the empty string. 
- The use of uuid4 unnecessarily restricts the size of the auth token. In this pull request, I still use 40 bytes to keep the token compatible, but this opens up the possibility of increasing security later.

Current implementation:
- Generate the random bytes using uuid
- Convert to hex using hmac

Implementation in this pull request:
- Generate the random bytes using urandom ([the backend for uuid4](https://github.com/python-git/python/blob/master/Lib/uuid.py#L527)) 
- Convert to hex using hexlify