Fixed Security::token

Fixed `Security::token`
* Improved hash algo
* Added random length and padding params
* Removed all unneeded chars

Now `Security::token` result may contain A-Z, a-z, 0-9, `-` and `_`. `=` is also used if `$padding` is true.

See [RFC 3548](http://tools.ietf.org/html/rfc3548) for the definition of URL-safe base64.

I don't think giving the choice whether to keep the '=' padding or not is important here.

From the RFC you linked:
>   In some circumstances, the use of padding ("=") in base encoded data
   is not required nor used.  In the general case, when assumptions on
   size of transported data cannot be made, padding is required to yield
   correct decoded data.

I suggest you either keep it or trim it.