There is no need to "verify" it was just a $loginkey used for automatic login. It's just a hash of: md5(lc($usename).”::”.lc($bcrypt-string)) They generate one

There is no need to "verify" it was just a $loginkey used for automatic login. It's just a hash of: md5(lc($usename).”::”.lc($bcrypt-string)) They generate one and store it in the database and just do a basic string compare against the one used to auto-login.