Improved and simplified authentication.

Switched salt and pepper names to better align with standards.
Removed session specific salt.
Removed IP address requirement for session signature.
Session signature now won't persist across changing passwords.
Made cookies HTTP only and included a comment about securing them.