hash tokens in database

implementation for discussion in #80

- add cookie_secret_file
- store cookie_secret on disk (or env or config file), instead of in database
- hash tokens in database (uses PasswordType from SQLAlchemy-Utils)
- don't persist configproxy token in db (restarting Hub requires restarting proxy, unless token is stored in env or config)
This is throwing a unicode warning on python2 with the API token check.  I think the culprit is https://github.com/jupyter/jupyterhub/pull/81/files#diff-09e41de2f86321f654d5d9f6a9205a85R69.  The auth header is bytes on Python 2.