Remove another reference to Blowfish

Signed-off-by: Michal Čihař <michal@cihar.com>
Document that we are using AES for encryption

Signed-off-by: Michal Čihař <michal@cihar.com>
Remove some blowfish mentions

Signed-off-by: Michal Čihař <michal@cihar.com>
Use random per session key for encrypting password

This makes it impossible to decrypt cookies later if the key would be
compromised.

Signed-off-by: Michal Čihař <michal@cihar.com>
Use phpseclib for generating session encryption key

Signed-off-by: Michal Čihař <michal@cihar.com>
Adjust tests to new encryption

Signed-off-by: Michal Čihař <michal@cihar.com>
Document AES usage

Signed-off-by: Michal Čihař <michal@cihar.com>
Factor out cookie storing to separate methods

Signed-off-by: Michal Čihař <michal@cihar.com>
Properly store password in cookie when changing it

Use auth plugin method to do that, otherwise it could not work properly
with autogenerated blowfish_secret.

Signed-off-by: Michal Čihař <michal@cihar.com>
Move password change handling to authenticaton plugins

We should not care about plugin type while changing password, we should
just notify it and the plugin should be responsible for anything needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
Do not pas arround empty $_url_params variable

Signed-off-by: Michal Čihař <michal@cihar.com>