in src/main/java/org/apache/sling/auth/form/impl/TokenStore.java [171:182]
private String encode(final long expires, final String userId,
final int token, final SecretKey key) throws IllegalStateException,
NoSuchAlgorithmException, InvalidKeyException {
String cookiePayload = String.valueOf(token) + String.valueOf(expires)
+ "@" + userId;
Mac m = Mac.getInstance(HMAC_SHA256);
m.init(key);
m.update(cookiePayload.getBytes(StandardCharsets.UTF_8));
String cookieValue = byteToHex(m.doFinal());
return cookieValue + "@" + cookiePayload;
}