Injectable, known token references

[gocom]

Textile uses stored reference tokens to insert spans to the parsed document. This has some problems, in both security and usability. For one, if tokens are used, there needs to be;

• address randomization; nobody must know the reference. If they do, they can fetch the reference from the cache themselves, bypassing any post-filtering that would normally occur.
• the tokens must never appear in the document itself.

Basically, the document should be checked for the token prefix before its used. Textile isn't event/reference based so there is change of token appearing in the content if its not there before hand.

If the prefix is in the document, try generating a new one, until a free prefix is found.

[gocom]

Oh, yeah, poop -- accidental 'issue' in commit message.