Fixed secure form hash for special url.

No htmlspecialchars encode and without fragment identifer.
Removed unnecessary conditional branch, fixed test and comment.
Add additional test case for named parameters.

Refs #3525
Merge branch 'secure-form-url-special'

Merge pull request #3525 into master. This fixes additional issues with
form tampering prevention by accomodating more URL types.
Optimize renew().

Don't call session_id() twice when we can use a local variable to store
the current session id.

Fixes #3531