#Start a password reset

  @user = User.find_by_email
  @user.update_attribute :password_reset_nonce, rand(16 ** 16).to_hex
  #mail them the password reset email


  #Look up a user for a password reset

  @user.find_by_password_reset_nonce params[:password_reset_nonce]
  #if nil, above line returns random user on some databases.  Oops.
  session[:user_id] = @user  #Logs in user
  #We assume if they know the nonce that proves they own email.
  redirect_to passwordReset_url

I've elided additional code which might theoretically be used to make the nonce expire and to prevent re-use for brevity, but it's possible that neither of these measures would fix the issue.

Bugs like this one always make me think "There but for the grace of God go I."