Question: I'm doing a system to reset password and I need pass email on URL like this:

```
http://example.com/reset?email=email@domain.com&token=89s8ads9

```

I'm doing this:

```
    return $this->redirect(array(
        'controller'=> 'site',
        'action'=> 'resetaSenha',
        '?'=> array('email'=> 'email=email@domain.com', 'token'=> 89s8ads9)
        )
    );

```

But is returning this:

```
http://example.com/reset?email=email%40domain.com&token=89s8ads9

```

Answer: 
`%40` is @ urlencoded.

Something in your code is converting @ to %40 for you. <http://php.net/manual/en/function.urlencode.php>

You can decode it with `urlencode($_GET['email']);` which will replace the %40 with an @
Do a captcha check, and deny access to the e-mail sender after the session var is unset.