[UPDATE] Security updates and fixes

 * Config changes
   * Moves csrf, twofactor and maxfailed sections + 2 new config sections from global config into security.dist.inc.php
     * The defaults are sane enough that everyone can use them without annoyance
   * Simple config checker that will run for admins unless disabled in the global config

 * Strict mode, which is enabled by default:
   * Shims mysqli and run php filters against incoming data
   * Validates client requests (IP, session, useragent - configurable)
   * Uses the Memcache request limiter; see below

 * Strict mode, disabled by default:
   * Validating server on requests
   * Redirect to ssl pages sitewide

 * Rate limiting requests, which is enabled by default:
   * Adds the ability to limit the number of requests from the same IP down to X requests per Y time
   * Uses Memcache; no DB hits
   * This should cut down on some of the resource intensive pages being abused
   * Defaults protect everything and limit requests to 30 per 1 minute for site, 20 per 1 minute for api
   * Allows you to set a custom error page