keep salting generated tokens

all the savings are in rounds, but keep salt because it still prevents the ability to hash a token once and check it against the whole db

jupyterhub/orm.py

@@ -243,7 +243,7 @@ class Hashed(object):
     # values to use for internally generated tokens,
     # which have good entropy as UUIDs
     generated = True
-    generated_salt_bytes = b''
+    generated_salt_bytes = 8
     generated_rounds = 1
 
     @property

jupyterhub/tests/test_orm.py

@@ -67,7 +67,10 @@ def test_tokens(db):
     assert found.match(token)
     assert found.user is user
     assert found.service is None
-    assert found.hashed.startswith('%s:1::' % orm.APIToken.algorithm)
+    algo, rounds, salt, checksum = found.hashed.split(':')
+    assert algo == orm.APIToken.algorithm
+    assert rounds == '1'
+    assert len(salt) == orm.APIToken.generated_salt_bytes * 2
 
     found = orm.APIToken.find(db, 'something else')
     assert found is None