Remove a potential denial of service vector where the login delay option could consume all web server resources.

Issue #1722814 by webservant316, deekayen: using % in custom tokens makes a mess with extra em tags, so I changed them all to plaintext.

Issue #722748 by Weka, pthurmond: Conflict with LoginToboggan unsets validate array, so this checks for it now.

Issue #1810160 by retiredpro, sabsbrain: Undefined index: status in login_security_user_update() on line 75 of login_security.module upon saving a profile2 page.

Issue #1908378 by fraweg, deekayen: Undefined index: messages in login_security_validate. Moved the isset() to check that earlier in the validate hook.

Issue #1906774 by fraweg, deekayen: On failed login the last login is shown. Moved some of the code to hook_submit for apparently different bootstrap process and changed how to identify a failed login by grepping for the password recovery url in the failure message.