Prevent hash length extension attack

refs Redmine #4701
refs Github #348
see http://blog.whitehatsec.com/hash-length-extension-attacks/

Thanks @birkir
Merge pull request #569 from kohana/3.3/security/prevent-hash-length-extension-attack

Prevent hash length extension attack