core: use unique token for 'rememberme' cookie.
Token is reset if the user's password is changed.

(cherry picked from commit ca9ae2b1fccac50e55eeddec3f84e3ec415ffb20)