fix(security): Implements stronger remember me cookie strategy

This implements remember me tokens using a greater entropy pool,
replacing codes as users return to the site, and mitigating a
brute-force attack by introducing a delay when an invalid elggperm
cookie is given. For admins, the tokens are removed immediately.
Merged in 17_remember_me (pull request #12)

Implements stronger remember me cookie strategy for 1.7
chore(release): Updated CHANGES.txt.