security(tokens): adds HMAC API and improves token-based security

Uses HMAC and constant-time string comparison for tokens in actions,
friend invites, password resets, and email validation.
Merge pull request #7597 from mrclay/5368_110

security(tokens): adds HMAC API and improves token-based security