FYI, this change is also a bad idea. The goal is not to create a hash, but to display a message to the user saying ``an email has been sent to ...@gmail.com``. the goal being always the same: avoiding to leak the email adddress when the client used the username to request the password