Fixed Security::token

Fixed `Security::token`
* Improved hash algo
* Added random length and padding params
* Fixed all unneeded chars

Now `Security::token` result may contain A-Z, a-z, 0-9, `-` and `_`. `=` is also used if `$padding` is true.