Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
I think it's confusing to use byte length here. The length of a hex string is also byte length. If only even number should be supported, then it's better to throw exception.