Tips on implementing password reset

[eluser]Crimp[/eluser]
New password:

1. Old password
2. New password
3. Repeat new password

Forgotten password/activation:

At 3) The controller method (login/reset) checks the validity of the hash against the db entry. If no match, no reset -> exit. You supply the new password (which can be changed, like above).