Question: What is safer? Should I send an email with a URL that expires to users to reset their password or should I email a newly generated password?