Is there anything wrong with this password reset procedure?
The best solution is use email address as username,then  user just have to remember his email address.And you just only have to validate user's email address.
Is there anything wrong with this procedure?

Enter in username and email in a reset form.
Flask creates a really long random string and stores it into the session under "reset_code".  Session will also have a key for "reset_pw_username"
Flask sends an email with a link to the path /password_reset/reset_pw_username/reset_code
That link displays a form where the customer can reset the password if the session reset code matches the session reset_code item. Otherwise it bombs out.
The session will expire the reset code after an hour.