secured unserialize

Implementation of secured unserialize() RFC here: https://wiki.php.net/rfc/secure_unserialize
- update for BC-compatible unserialize
- add tests