FEATURE: per client user tokens

Revamped system for managing authentication tokens.

- Every user has 1 token per client (web browser)
- Tokens are rotated every 10 minutes

New system migrates the old tokens to "legacy" tokens,
so users still remain logged on.

Also introduces weekly job to expire old auth tokens.

config/discourse_defaults.conf

@@ -147,3 +147,6 @@ relative_url_root =
 # this ensures backlog (ability of channels to catch up are capped)
 # message bus default cap is 1000, we are winding it down to 100
 message_bus_max_backlog_size = 100
+
+# must be a 64 byte hex string, anything else will be ignored with a warning
+secret_key_base =

config/initializers/100-secret_token.rb

@@ -1,14 +1,4 @@
-# We have had lots of config issues with SECRET_TOKEN to avoid this mess we are moving it to redis
-#  if you feel strongly that it does not belong there use ENV['SECRET_TOKEN']
-#
-token = ENV['SECRET_TOKEN']
-unless token
-  token = $redis.get('SECRET_TOKEN')
-  unless token && token.length == 128
-    token = SecureRandom.hex(64)
-    $redis.set('SECRET_TOKEN',token)
-  end
-end
-
-Discourse::Application.config.secret_token = token
-Discourse::Application.config.secret_key_base = token
+# Not fussed setting secret_token anymore, that is only required for
+# backwards support of "seamless" upgrade from Rails 3.
+# Discourse has shipped Rails 3 for a very long time.
+Discourse::Application.config.secret_key_base = GlobalSetting.safe_secret_key_base