Improved player name regex and accounts controller security and performance

The regex is highly tested and is as rigid as Tibia's.

Password comparison should be always done using identity comparison (===) as it is more type safe ([reference](http://www.php.net/manual/pt_BR/language.operators.comparison.php#66245))

`hash('sha1', $string)` is much more performatic than `sha1($string)` ([reference](http://us2.php.net/manual/pt_BR/function.hash.php#73792))