private static function create_login_token() {
        global $SESSION;

        $state = [
            'token' => random_string(32),
            'created' => time() // Server time - not user time.
        ];

        if (!isset($SESSION->logintoken)) {
            $SESSION->logintoken = [];
        }

        // Overwrite any previous values.
        $SESSION->logintoken[self::$logintokenkey] = $state;

        return $state;
    }