How is sending a user an email complex, confusing or error-prone? As for security, given that an account can already be accessed if one has access to the holder&#x27;s email (which is the case for any password reset flow relying on email), this is no more insecure than the current state.<p>Seriously, this sort of thing is not complex, not at <i>all</i>.