What's the issue? They force a reset so there is no difference between giving a temporary password like this or a URL which is unique to them?