Refactor remember me to use a HMAC using the site secret

This change will defeat attacks on the login token where the attacker does not know the application's site secret.