Optional $mail parameter added in user_pass_rehash()

Summary

• The user_pass_rehash function has a new optional parameter $mail.
• Allows to invalidate password reset links once the user email is changed.
• If the $mail parameter is not supplied, then the hash will be calculated using the email address from the loaded user object.

Before

// The old way of calling user_pass_rehash
$hash = user_pass_rehash($password, $timestamp, $login, $uid);

After

// The new way of calling user_pass_rehash
$hash = user_pass_rehash($password, $timestamp, $login, $uid, $mail);

Any existing unused reset links generated before this change is applied will no longer be valid after the change is deployed. Users should be able to request new reset links that will work as expected.