More fix: two validation records would collide if generated at the

same millisecond. Use a persistent random, and include the userId
and a bit of the timestamp to make a secret that cannot collide
with another user's secret.

src/main/java/com/threerings/user/depot/DepotUserRepository.java

@@ -13,7 +13,6 @@ import java.util.Collections;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Random;
 import java.util.Set;
 
 import com.google.common.collect.Lists;
@@ -937,11 +936,7 @@ public class DepotUserRepository extends DepotRepository
         deleteAll(ValidateDepotRecord.class, new Where(ValidateDepotRecord.USER_ID.eq(userId)));
 
         // create a new one and insert it into the database
-        ValidateRecord rec = new ValidateRecord();
-        rec.secret = Long.toString(Math.abs((new Random()).nextLong()), 16);
-        rec.userId = userId;
-        rec.persist = persist;
-        rec.inserted = new Date(System.currentTimeMillis());
+        ValidateRecord rec = ValidateRecord.create(userId, persist);
         insert(ValidateDepotRecord.fromValidateRecord(rec));
         return rec;
     }