fix(security): Implements stronger remember me cookie strategy

This implements remember me tokens using a greater entropy pool,
replacing codes as users return to the site, and mitigating a
brute-force attack by introducing a delay when an invalid elggperm
cookie is given. For admins, the tokens are removed immediately.
chore(htmlawed): Added more comprehensive tests for HTMLawed.

Fixes #6297
Merge pull request #6598 from brettp/htmlawed_tests

chore(htmlawed): Added more comprehensive tests for HTMLawed.
fix(views): rss w3c validation improvements
Merge pull request #6624 from beck24/rss-validation

fix(views): rss w3c validation improvements
Merged in remember_me (pull request #13)

Implements more secure remember me strategy for 1.8
Merge remote-tracking branch 'bb/1.8' into 1.8
fix(ui): Fixed ajax loader's ID attribute.
chore(release): Updated CHANGES.txt.