Kernel / Bundle fixes

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | ---
| Fixed tickets | ---
| Refs tickets  | ---
| License       | MIT
| Doc PR        | ---

This makes sure bundles are added to the kernel before they are updated. As the logic has to be placed pretty early in the execution flow, it can only use basic url checks. This also introduces a new kernel parameter called `url_secret` to make sure that only admins can cause bundles to be added to the kernel. 
I couldn't think of a better way to handle this chicken-egg problem. :chicken: :egg: 

**You will need the `url_secret` parameter by hand to your dev versions (in [custom_]parameters.yml) and set it to a random string.**