    protected function generateCookieHash($class, $username, $expires, $password)
    {
        return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());
    }
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.