code: public String generateResetToken(User user) {
      	String encryptedToken = tokenEncryptor.encrypt(user.getUsername() + SEPARATOR
                  + simpleDigester.digest(user.getPassword()) + SEPARATOR
                  + System.currentTimeMillis());
      	
          return UrlEncoder.QUERY_INSTANCE.encode(encryptedToken, HTTP.ISO_8859_1);
      }
docs: A reset token looks like:
  USERNAME-sep-DIGEST(USER_PASSWORD_HASH)-sep-currentTimeMillis