Don't use hard coded keys for client side state

[zregvart]

Client side state persistence is using hard coded keys in application.yml, they should unique per install and possibly should be rotated periodically.

Things to think about:

• do we need this statically or dynamically (think regenerate keys every n days)
• do we do this via k8s secrets
• if dynamically how to handle the transition (need n-1 keys)
• if dynamically then we need key distribution (spring cloud k8s, but it reloads the app context)

See #459 (review)

[zregvart]

If not specified in the configuration (i.e. environment) the backend now defaults to randomly generated keys. Still needs some thought on how to properly store the keys across restarts and cwithin a cluster and how to rotate the keys.