protected function _getToken($userId = null) {
        if ($userId
            && $this->_getAuthVars()
            && array_get($this->_getAuthVars()->toArray(), 'reuse_existing_token')
        ) {
            return $this->_fetchExistingToken($userId) ?: $this->_getToken();
        }
        if (function_exists('openssl_random_pseudo_bytes')) {
            return bin2hex(openssl_random_pseudo_bytes(32));
        }
        return mt_rand();
    }