code: public function startPasswordResetSession($user)
      {
          $this->session->migrate(true);
          $this->session->set("pwreset", array(
              'user' => $user,
              'validity' => time() + $this->config["resetTimeout"]
          ));
      }
docs: Starts a password reset session
  
  A password reset session is active when session key pwreset is present,
  which contains user identifier of the user who the reset session is valid
  for and an expiration date after which the password session cannot be used
  to change a password.
  
  @param string $user The user identifier