[mmcnickle]

Yes, a password reset token is a good example where it would be fine to used a HMACed token, and is exactly how Django handles password resets [1].

[1] https://github.com/django/django/blob/master/django/contrib/...