SHA256 everywhere

Follow up #645. cc @mastahyeti 

* Move to SHA256 as default digest class
* Clarify byte digest vs hexdigest on Asset
* Cache raw byte digest and convert to hex or base64 when needed
`/` isn't, but other characters do need to be escaped. Specifically, I was thinking of `+`. I think that shows up in a few content-types.