Fix up some security holes.

First, the secret token is now generated randomly, which is necessary
because our code is open. Second, user remember tokens are encrypted.
Minor fix.