protected function createNewToken(CanResetPassword $user)
    {
        $email = $user->getEmailForPasswordReset();

        $value = str_shuffle(sha1($email . spl_object_hash($this) . microtime(true)));

        return hash_hmac('sha1', $value, $this->hashKey);
    }