Use hash_hmac SHA-1 when generating reminder tokens. Closes #1040.