As this only needs to be stable for concurrent requests, 1 minute
instead of 1 day should be enough. We also add the user-agent to the hash
to also generate different pins for users sharing the same IP (hopefully).