security(tokens): adds HMAC API and improves security of friend invite token

FYI this just flattens this and changes it to use the new elgg_validate_invite_code()