Thanks for the question!

The main reason was that with this change I kept implementation before that – see [the code in red](https://github.com/Automattic/camptix/pull/69/files#diff-5cb4f0974d7e507f6aa5827e23e12aadL3997)).

I remember, though, that I looked at the token generation (I didn't do anything about it):

* `openssl_random_pseudo_bytes` is available since PHP 5.3 and WordPress (and our plugins) has to be 5.2-compatible.
* There is `wp_generate_password()` function, which generates a random string, similar to `uid`.
* I then looked at [wp_rand()](http://core.trac.wordpress.org/browser/trunk/src/wp-includes/pluggable.php?rev=26000#L1552), which doesn't look statistically random at all, but I got into the rabbit-hole of trying to test with [dieharder](http://www.phy.duke.edu/~rgb/General/dieharder.php). Unfortunately `wp_rand` is too slow and `dieharder` didn't finish in few hours. I had given up by then.

As a result of your reminder, here is [a pull request](https://github.com/Automattic/camptix/pull/70), which switches to `wp_generate_password()` and I may look further in the statistical randomness of `wp_rand()`.