Most people used canned packages in Rails with something like Devise. Looking at the source it looks like the token is pulled right off the params:

https://github.com/plataformatec/devise/blob/master/app/cont...

The reset routine uses Rails finder mechanism to do just what the OP discusses:

https://github.com/plataformatec/devise/blob/master/lib/devi...

I don't use MySQL because for reasons just like this - so I'm not all that surprised. That said - it would be interesting to see Devise put to the test to see if it is indeed a problem for Devise.

This is not, however, a Rails issue.