security(tokens): adds HMAC API and improves token-based security

Uses HMAC and constant-time string comparison for tokens in actions,
friend invites, password resets, and email validation.

Replaces #7245
We have elgg_strlen. Is that different? http://reference.elgg.org/1.9/mb__wrapper_8php.html#aea38ba21f4c277ef1d8f88aff5dc543a