OK, I should have read the email more carefully :) - the confirmation link is there, and the new password only takes effect after clicking the confirmation link. In my defense, the email message could have been worded a bit better, and maybe point to a "set your password" link, to avoid se...