Password reset token is hilariously insecure

[mithrandi]

This code:

mantissa/xmantissa/signup.py

Line 228 in 53e5502

return unicode(hashlib.md5(str((usern, time.time(), random.random()))).hexdigest())

This should just use urandom. As it stands, I think an attacker can obtain one of these tokens and reverse it to get the state of the random.random() generator, then brute-force somebody else's token with a relatively tiny number of attempts.