security(tokens): adds HMAC API and improves token-based security

Uses HMAC and constant-time string comparison for tokens in actions,
friend invites, password resets, and email validation.

Replaces #7245
It could go there, or in a SecurityToken service, or... I figure we can easily move it later.