function yourls_create_nonce( $action, $user = false ) {
	if( false == $user )
		$user = defined( 'YOURLS_USER' ) ? YOURLS_USER : '-1';
	$tick = yourls_tick();
	$nonce = substr( yourls_salt($tick . $action . $user), 0, 10 );
	// Allow plugins to alter the nonce
	return yourls_apply_filter( 'create_nonce', $nonce, $action, $user );
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.