Use an externally supplied hash salt to protect one-time login links and form tokens.

So currently this means, people working on development VM using a database dump (or anyone else getting its hands on one) can generate one-time logins links.