favouriteduck

I'm guessing the HN web server has a particularly narrow interpretation of the HTTP/1.1 spec:

    For compatibility with HTTP/1.0 applications, HTTP/1.1
    requests containing a message-body MUST include a valid
    Content-Length header field unless the server is known
    to be HTTP/1.1 compliant. If a request contains a 
    message-body and a Content-Length is not given, the
    server SHOULD respond with 400 (bad request) if it
    cannot determine the length of the message, or with
    411 (length required) if it wishes to insist on 
    receiving a valid Content-Length.

If you mean logging in via clicking a link in an email then it is too much of a security risk. Think of all the places that URL can end up in: browser history, bookmarks, etc.

It works for password reset because the window of opportunity is small (just a few minutes) and it is a once-only operation (visiting the URL again should not reset your password again).

No.

Well that was a let-down. I didn't know about this gimmicky fan. I thought someone had put fins on a Dyson sphere. That would be way cool.

or really big oxygen molecules o_O