Fixed Security::token

Fixed `Security::token`
* Improved hash algo
* Added random length and padding params
* Removed all unneeded chars

Now `Security::token` result may contain A-Z, a-z, 0-9, `-` and `_`. `=` is also used if `$padding` is true.

See [RFC 3548](http://tools.ietf.org/html/rfc3548) for the definition of URL-safe base64.

Kindly do not submit formatting changes with this PR. Make them separate PR if those changes are important.