Fixed Security::token

Fixed `Security::token`
* Improved hash algo
* Added random length and padding params
* Removed all unneeded chars

Now `Security::token` result may contain A-Z, a-z, 0-9, `-` and `_`. `=` is also used if `$padding` is true.

See [RFC 3548](http://tools.ietf.org/html/rfc3548) for the definition of URL-safe base64.

Could you please set the default `$n = 16` here? Why did you choose 16 (it was openssl_random_pseudo_bytes(32))?