The password link must contain a cryptographically secure token. It should not contain the user's ID or email in plain text.