[jpalomaki]

One option is to avoid putting the token to the link and at least provide user a simple way of copy-pasting the token to the password reset form.

Sometimes this is actually something I as user want to have, since it might be that I'm receiving the email on device A, but want to reset the password on device B.

And please keep the password reset tokens sane. If you are not encoding some data into the token, you don't really need that 80 character random string for security.

[derekprior]

I'd certainly consider this for some applications. It depends on the value of what you are protecting. For some sites and users, the error rate introduced by this method would be unacceptable.

Tradeoffs...

[tinus_hn]

Many people do not understand copy and paste at all.