For anon users, the basket ID is stored in a cookie.  Previously, this
was stored with a simple crc32 hash to prevent users enumerating baskets
by changing their cookies.  However, home-rolled encryption is always a
bad idea.  In this case, it may have probably exposed too much
information allowing the SECRET_KEY to be determined.

This change switches away from the home-rolled encryption to use
Django's built-in crypto signing functionality to store the basket ID.

Thanks to Raphael Kimmig for reporting this issue and providing this
patch.