public function createRecoveryToken(User $user): UserResetToken
    {
        if (!$this->resetTokenProvider) {
            throw new PasswordResetProhibitedException('The configuration currently prohibits the resetting of passwords!');
        }

        $auth = $this->authenticationProvider->findByUserId($user->getId());
        if (!$auth) {
            throw new NoSuchUserException();
        }

        if ($this->resetTokenProvider->getRequestCount($auth) > 5) {
            throw new TooManyRecoveryAttemptsException();
        }

        $this->resetTokenProvider->invalidateUnusedTokens($auth);

        $remote = new RemoteAddress();
        $remote->setUseProxy(true);
        $token = new UserResetToken($auth, $remote->getIpAddress());
        $this->resetTokenProvider->save($token);

        return $token;
    }