Use shorter application references

Length is currently set to 8 (hyphenated 4-4), which gives about a
trillion unique identifiers.

Instead of obfuscating the ID, the token is now randomly generated and
stored in the database.
Check for collisions when generating app refs

The expected number of applications in the system at any time is about
20,000. With an eight-digit base-32 reference, the probability of a
collision is about 0.000018. That's low, but it's high enuogh to worry.

Thus, we check against existing applications references and simply
generate another random reference if there is a collision. This does
still leave a race condition, in that two simultaneous applications
could generate the same reference. The probability of two simultaneous
generations colliding is one in a trillion, however.
Simplify app ref generation

This works because 256^5 = 32^8. The downside is that we can't easily
generate different length references any more.
Merge pull request #394 from ministryofjustice/random-app-refs

Random application references