In our community we have "Reset your password" page which simply run the following code:
Then user receives an email with a link: https://XXX.XXX.force.com/XXX/secur/forgotpassword.jsp?r=XXX&display=page&fpot=XXX
It leads a user to a page where he can change his password. Changing password works as expected. But, if he opens that link and doesn't change a password, then he can't go to any other page (Login, Register, etc.).
User clicks links, browser changes url, but the page remains the same, asking user to enter new password. Open other pages in different tabs doesn't help. Only closing the browser, or deleting cookies helps.