Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
We might consider using http://php.net/manual/en/function.base-convert.php to get a shorter string using more characters to represent the value.