Fixed Default Char Selecter

This fixes #2. Updated to correctly use the $user->setDefault()
function. Also added the $db variable to be passed directly in the
function, in a further effort to best practice everything via OOP.
Best Practice Updates (OOP-related)

Moved the random string generator for sessions out to functions.php, so
it can also be used with the Admin jointoken generation. Updated all
User functions to use the new private variable $db when possible, or
pass in the $db class when called as a static function rather than
globalizing any of it. Finally, moved the bruteInsert function back into
the User class, because it was just stupid for it to be its own
function.