Use HMAC construction for remember me cookie hashes
[Security] updated CHANGELOG (refs #8195)