Preserve entropy in TokenGenerator

base_convert loses precision on large inputs. Use URL-safe base64_encode instead.
Enforce POST for /login_check
Used 2.1 syntax
Merge pull request #1103 from kbond/patch-1

Enforce POST for /login_check
Merge pull request #953 from jmclean/patch-1

Preserve entropy in TokenGenerator
When resetting password check that requested user is not expired and/or disabled