Use HMAC construction for remember me cookie hashes
merged branch joncave/rememberme-hmac (PR #8195)

This PR was submitted for the 2.3 branch but it was merged into the master branch instead (closes #8195).

Discussion
----------

[Security] Use HMAC construction for remember me cookie hashes

[Security] Use HMAC construction for remember me cookie hashes

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

HMAC is a more secure construction for MACs than the secret suffix method that is currently being used by the remember me cookies, see http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-hashes-use-hmac/.

Changing the MAC scheme means that current cookies will be invalidated and users will have to login again. Though there are no API BC issues.

Commits
-------

c97e0d0 [Security] Use HMAC construction for remember me cookie hashes
[Security] updated CHANGELOG (refs #8195)