Building a secure password reset

This is already an active post on the front page of HN: <a href="http://news.ycombinator.com/item?id=4280440" rel="nofollow">http://news.ycombinator.com/item?id=4280440</a>