Backport of #795 to 3.x

Because of how browsers handle the `Location` header, values beginning
with `\` can be leveraged to create redirect targets on other domains.

Thanks to Volker Dusch and the PHP Ecosystem security team for reporting this.

The firebase/php-jwt package contains a vulnerability that can only be
resolved by going to 7.x. I didn't want to also change the requirements
of this package as part of the redirect fix.

Fix an open redirect weakness in getLoginRedirect()

Update link to finder documentation

…factor-bounded HMAC-SHA256 tokens

Backport of #805 to 3.x

3.x - security: replace unencrypted cookie auth tokens with verified, work-factor-bounded HMAC-SHA256 tokens