Shorter application references

This makes the application references shorter by removing the erroneous use of `to_s` before base 32 encoding.

* Before: `64T3CDSN6CTKEDHM`
* After: `1BQHMCM`

In addition, this introduces a different secret key for application reference obfuscation. This is done to ensure that sessions can be rolled (by changing `SECRET_KEY_BASE`) without breaking all saved applications. This requires a new environment variable, `APP_REF_SECRET_KEY` (attn @mattmb).