Maybe uniqid() alone (without sha1 and salt) is sufficient here.