Move object ID, token, and random string generation into their own
module, cryptoUtils.
Remove hat dependency, which was used to generate session and some other
tokens, because it used non-cryptographic random number generator.
Replace it with the cryptographically secure one. The result has the
same format (32-character hex string, 128 bits of entropy).
Remove randomstring dependency, as we already have this functionality.
Add tests.
In _User collection a field _session_token is present and if you fetch
the user data form server, this field override the sessionToken saved
in your browser.
If you don't fetch the user, all request to server contain the right
sessionToken and if you fetch the user data from the server, all next
requests will contain the wrong sessionToken come form the
_session_token in user data fetched.
