public function setPasswordAction()
    {
        $userId = $this->params()->fromRoute('userId', null);
        $token = $this->params()->fromRoute('token', null);

        if ($userId === null || $token === null) {
            return $this->notFoundAction();
        }

        $user = $this->getUserMapper()->findById($userId);

        if (!$user) {
            return $this->notFoundAction();
        }

        $record = $this->getUserRegistrationMapper()->findByUser($user);

        if (!$record ||  !$this->userRegistrationService->isTokenValid($user, $token, $record)) {
            // Invalid Token, Lets surprise the attacker
            return $this->notFoundAction();
        }

        if ($record->isResponded()) {
            // old link, password is already set by the user
            return $this->redirectToPostVerificationRoute();
        }

        $form = $this->getServiceLocator()->get('HtUserRegistration\SetPasswordForm');

        if ($this->getRequest()->isPost()) {
            $form->setData($this->getRequest()->getPost());
            if ($form->isValid()) {
                $this->userRegistrationService->setPassword($form->getData(), $record);

                return $this->redirectToPostVerificationRoute();
            }
        }

        return array(
            'user' => $user,
            'form' => $form
        );
    }