Secure low JavaScript token validation

[r1kka6]

Summary

• replace the deterministic client-derived Low token with a cryptographically random session-bound token
• validate Low submissions server-side with hash_equals() and rotate the token after each attempt to stop replay
• remove the client-side MD5 / ROT13 generator so the browser no longer computes a forgeable token

Verification

• php -l passed for vulnerabilities/javascript/index.php and vulnerabilities/javascript/source/low.php
• vulnerable baseline accepts the public token 38581812b435834ebf84ebcc2c6424d6 for phrase=success
• patched runtime accepts one issued 64-hex token once, rejects replay of the same token, and rejects the old deterministic token