Add media_isexternal

Added comment to DiffFormatter _escape() method

FS#2415, add $INFO to mediamanager

AUTH_PASSWORD_GENERATE event added

reloading the user list after the delete action will make sure the count
is always correct.

If you want better random initialization and more control over the
password strength install the passpolicy plugin.

This is needed to replace the password generator by a plugin
implementation. Related to PR #166 and FS#2147

Clean internal ids in ml(), that it matches with fetch.php

Do not pass timelimit and deref settings to ldap_search. These values
should be set globally via ldap_set_option() instead (as we do for
deref).

Implement HMAC for signature tokens

No need for HMAC here because there's no length attack vector here. We
only care for the existance of the file and each reset request is
completely (random) independent from each other.

ml() can built url to these images, either fetch didn't accept them.

Informative as sample implementation too

The resize token was broken because fetch.php cleans the id before the token calculation, while ml() uses the raw id

Clarify use of _escape() method in base class.