core: use unique token for 'rememberme' cookie.
Token is reset if the user's password is changed.
doc: add change to rememberme cookie to release notes for 0.11