You'll be better off with a per-user random salt than the <email>+<site_const> scheme. If you later want to include/exclude a re-auth flow to your email change

You'll be better off with a per-user random salt than the <email>+<site_const> scheme. If you later want to include/exclude a re-auth flow to your email change process then you retain that flexibility (though as an end-user I dislike such additional barriers -- I suppose they thwart cookie stuffing and other kinds of vulnerabilities if your service is broken in that way, but I still don't like it).