protected function _getCancelCode()
    {
        if (!$this->has('password') && !$this->has('id')) {
            throw new FatalErrorException(__d('user', 'Cannot generated cancel code for this user: unknown user ID.'));
        }

        if (!$this->has('password')) {
            $password = TableRegistry::get('User.Users')
                ->get($this->id, ['fields' => ['password']])
                ->get('password');
        } else {
            $password = $this->password;
        }

        return Security::hash($password, 'md5', true);
    }