[Security] Use HMAC construction for remember me cookie hashes

[Security] Use HMAC construction for remember me cookie hashes

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| License       | MIT

HMAC is a more secure construction for MACs than the secret suffix method that is currently being used by the remember me cookies, see http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-hashes-use-hmac/.

Changing the MAC scheme means that current cookies will be invalidated and users will have to login again. Though there are no API BC issues.