Avoid storing secrets and tokens at rest

- OAuth access tokens *are* APITokens.
  oauth_access_tokens table only stores extra oauth metadata.
- only store hashed client_secret in database,
  using HashedCompare to allow comparison.

jupyterhub/orm.py

@@ -512,7 +512,6 @@ class APIToken(Base):
     """An API token"""
     __tablename__ = 'api_tokens'
 
-    # _constraint = ForeignKeyConstraint(['user_id', 'server_id'], ['users.id', 'services.id'])
     @declared_attr
     def user_id(cls):
         return Column(Integer, ForeignKey('users.id', ondelete="CASCADE"), nullable=True)