	private function _forgot_password_token($salt = FALSE)
	{
		// Secret consists of email and the last_login field.
		// So as soon as the user logs in again, the reset link expires automatically.
		$salt = $salt ? $salt : text::random('alnum', 32); // Limited charset to keep it URL friendly
		$key = Kohana::config('settings.forgot_password_secret');
		return $salt . hash_hmac('sha1', $this->last_login . $this->email, $salt . $key);
	}
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.