Clean internal ids in ml(), that it matches with fetch.php

Do not pass timelimit and deref settings to ldap_search. These values
should be set globally via ldap_set_option() instead (as we do for
deref).

Implement HMAC for signature tokens

No need for HMAC here because there's no length attack vector here. We
only care for the existance of the file and each reset request is
completely (random) independent from each other.

Informative as sample implementation too

The resize token was broken because fetch.php cleans the id before the token calculation, while ml() uses the raw id

This reverts commit 37764cbb.

FS#2767, fix for missing security token

ensure security token is included in media url when resize parameter is passed in string form, e.g. 'w=80'

The code that is removed in this commit has either never been used
(listIndexLenghts) or was completely broken (cacheIndexDir) and was
introduced in the indexer rewrite in 2010. The idea of the rewrite was
to update the readdir cache after every index change instead of on demand.
What the code actually did was removing every updated index from the
cache as it used a wrong if condition. Simply fixing the condition
wouldn't fix the problem as then only updated indexes would be added to
the cache and furthermore the rewrite simply ignored the readdircache
setting. For now the safest solution seems to be removing the code. It
could be added again in a changed form in a future version.

The suffix parameter is only for the word length in the word index and
not for the metadata index.