public function validateSecureToken($token, $userId)
    {
        $user = User::findOne($userId);
        
        if (!$user) {
            return false;
        }
        
        if ($this->userAttemptBruteForceLockHasExceeded($user)) {
            return false;
        }
        
        if ($user->secure_token == sha1($token) && $user->secure_token_timestamp >= (time() - $this->secureTokenExpirationTime)) {
            return $user;
        }

        return false;
    }