fix(security): Implements stronger remember me cookie strategy

This implements remember me tokens using a greater entropy pool,
replacing codes as users return to the site, and mitigating a
brute-force attack by introducing a delay when an invalid elggperm
cookie is given. For admins, the tokens are removed immediately.
Merged in remember_me (pull request #13)

Implements more secure remember me strategy for 1.8
Merge remote-tracking branch 'bb/1.8' into 1.8
fix(ui): Fixed ajax loader's ID attribute.
chore(release): Updated CHANGES.txt.