Should link to restore user account lead him to login page?

Question

Pinterest has a deactivate my account function.

After user deactivates his account, he gets an email with Reactivate account link:

Here Reactivate button links to login form with username and password.

But is it OK to link user to login form? I think at that point of time web application shouldn't expect user to know password so it would be better to show a form with just Password and Password Confirmation:

^{download bmml source – Wireframes created with Balsamiq Mockups}

After clicking Unlock my account user would be logged in. I don't see any security vulnerabilities in proposed approach if url to this form contains random unguessable token.

Answer 1

An 'unguessable' token can always be brute forced. Also, you are emailing the user the link in the first place (which contains the secret reactivation link) - e-mail is hardly secure. These are the reasons Pinterest probably requires you to log back in with your old password (so, to answer your question, yes, you should force the user to log in in order restore their account).

Edit: see the time-sensitive vulnerability regarding password reset e-mails