Generate join request's token on constructor, not on before save

A bit better to have the secret token always valid and not only when the
model is saved.
Also increased the length of the token to the default generated by
urlsafe_base64, because why not.

refs #1400