security(tokens): adds HMAC API and improves token-based security

Uses HMAC and constant-time string comparison for tokens in actions,
friend invites, password resets, and email validation.

Replaces #7245
Is this a deal-breaker?