This uses rand() to generate a one-time authentication code. rand() is insecure; you should assume that an attacker can set up conditions where its output is predictable. Use ActiveSupport::SecureRandom instead.

Also, why does this implementation needs its own special cookie? Why not just do the (minimal) housekeeping this requires in the Rails session? Magic cookies are usually a code smell.