Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
According to Anthony: str_shuffle has absolutely no business generating keys or anything to do with crypto. If mcrypt, /dev/urandom and openssl are all missing, you **must** error.

I think it's fine we add mcrypt into the minimum requirement (perhaps you misunderstood my previous comment about mcrypt).