Another trick is to mix in the user's hashed password when you generate and check the HMAC - that way if the user ever changes their password all the previous l

Another trick is to mix in the user's hashed password when you generate and check the HMAC - that way if the user ever changes their password all the previous links fail to work.