[WIP] Kernel / Bundle fixes

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | ---
| Fixed tickets | ---
| Refs tickets  | ---
| License       | MIT
| Doc PR        | ---

This makes sure bundles are added to the kernel before they are updated. As the logic has to be placed pretty early in the execution flow, it can only use basic url checks. This also introduces a new kernel parameter called `url_secret` to make sure that only admins can cause bundles to be added to the kernel. 
I couldn't think of a better way to handle this chicken-egg problem. :chicken: :egg: 

I will need to test the installation before merging.
Maybe: Add the code to a admin page / action, call it once, remove the code again.