in src/main/java/org/apache/sling/auth/form/impl/TokenStore.java [163:169]
String encode(final long expires, final String userId)
throws IllegalStateException,
NoSuchAlgorithmException, InvalidKeyException {
int token = getActiveToken();
SecretKey key = currentTokens.get(token);
return encode(expires, userId, token, key);
}