It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
When a user uses the »I forgot my password« link several times and gets a couple of emails, each one with a tokenized link to reset his password, what would be the appropriate behaviour? All links ...
I am building a prototype to a system that has a user account system in place. Of course with any account system, the user should be able to reset their password should the need arise (e.g., ...