Make ticket number unguessable

[bernhardreiter]

Split out from #28
Make the ticket number unguessable.

Implementation idea:
Add a table that keeps the used ticket ids,
draw new ones randomly until you find out that has not been in use.

Within our current design size:
100,000,000 possibilities for numbers per day
and aiming for sending out 1,000,000 mail per days,
this process will need a redraw in a max of 1% of cases.
So we are okay.

Less attractive implementation idea:
Using a festel chipher like suggested on the Postgresql wiki.
It is less clear to prove that the chipher will create no collisions
and what would be needed (in terms of the used "round" function or "key")
to make it unguessible, if the source is know.