Ask HN: How does HN's auth system work?

The only cookie saved for Hacker News is the "user" cookie, which supposedly is a token that refers to my user in HN's database. The only time this token is regenerated is when I logout, I'm not even sure it expires on the server. I wanted to ask, how is this token generated? Just randomly? Is there a best practice for generating this sort of token? Is it even called a "token"?