Signs a media token for userId, valid for 7 days. Media elements can't send an Authorization header, so the URLs of private files, thumbnails and playlist covers carry this token as ?token=, where it lands in logs and browser history. It only reads media, so a leaked URL doesn't expose the account.