R1:ab7d89edc8ad

Use better secrets in generating account tokens

Summary:
When we generate account tokens for CSRF keys and email verification, one of the inputs we use is the user's password hash. Users won't always have a password hash, so this is a weak input to key generation. This also couples CSRF weirdly with auth concerns.

Instead, give users a dedicated secret for use in token generation which is used only for this purpose.

Test Plan:
- Ran upgrade scripts.
- Verified all users got new secrets.
- Created…