Security enforcements:
> Switch password hashing from md5 to more secure hashing (backward compatible).
> Do not use the server time() as the base for the tokens (secure token & remember me cookie token) as it's too predictible
> Make sure the remember me cookie has httpOnly and Secure flags.