It is not encrypted. The only thing I think it *could* be encrypted with is the forgotPasswordToken which was also sent in the clear previously. @warner is this correct?