Don't store full cookie value in db. Integrate site secret into cookie value.
Refactor remember me to use a HMAC using the site secret

This change will defeat attacks on the login token where the attacker does not know the application's site secret.
Merging updates from Anthony. Fixing code style.