Update ion_auth_model.php

Use of microtime() alone is considered insecure.  
This function is precise to micoseconds.  
An attacker with a botnet of 1,000 bots who synchronizes the clock
with server time to 1 second only needs 1,000 tries per bot.

openssl_random_pseudo_bytes is cryptographically secure as it uses an
OS source (such as /dev/urandom).  The concatenation with microtime and mt_rand
is for legacy support and a second best option.