Use better source of entropy for mcrypt IV

Signed-off-by: Michal Čihař <michal@cihar.com>
Regenerate cookie encryption IV for every session

The IV for cookie encryption was generated just once for every browser
and kept in a cookie. Generating it for every session is much better to
avoid information leaks (eg. that same user has logged in).

Signed-off-by: Michal Čihař <michal@cihar.com>