use secure cookies

rather than setting tokens as plain cookies
remove cookie_secret from single-user servers

pass encrypted cookies to Hub for verification
Merge pull request #82 from minrk/secure_cookie

use secure cookies
BUG: Fix str/unicode warnings from SQLAlchemy on python 2.

When running with `reset_db=True` on python 2, several SQLAlchemy operations
were performed with bytes where unicode was expected, resulting in
warnings like the following.

```
/home/ssanderson/.virtualenvs/jupyterhub/local/lib/python2.7/site-packages/sqlalchemy/engine/default.py:573:
SAWarning: Unicode type received non-unicodebind param value.
  param.append(processors[key](compiled_params[key]))
```

Fixes a few stray non-unicode literals and adds a unicode safe wrapper
for `getpass.getuser`.