More secure token generate

Use openssl_random_pseudo_bytes().

New token length is 40, used char is [a-f0-9] (hex string), it same as previous.
If openssl_random_pseudo_bytes couldn't use, It will fallback to previous logic.