Some Security Enhancements

* Use AES instead of DES as the default encryption (DES was retired nearly a decade ago: http://www.hsdl.org/?view&did=18489)
* Null key? Don't use hex-encoded MD5, use raw SHA-256 instead. If the hash() function isn't available, use a lazy hack to force a more random byte string. (Feel free to improve this. I'm not happy with still using MD5.)
* Constant-Time string comparison for HMAC verification, courtesy of the constant time comparison function on https://defuse.ca/secure-php-encryption.htm

Personal statement: I only heard of this framework because it's popular, and since you use HTMLPurifier I thought it was worth checking out. Not as horrified as I was with CodeIgniter :)