Security Enhancement: Cross Site referrer Issue

[xanatas]

If i have a link to in external site on my login form a user could potentialy click on this hence sending
the referrer URL /mysite.com/resetPassword/token23097xcas01 in referrer header

Possible misuse of password reset token if not used by user before clicking on the external link.

Option
1: Do not Link to external sites or
2: Expire on click of link (probably only implementable on meteor dev level?)
3 (Implementable here): Store token in Session and forward directly to mysite.com/resetpassword