"user:one-time-login-url" token not getting replaced by token_replace
To replace that token, you need to call token_replace() as token_replace($email, array('user' =&gt; $_user), array('callback' =&gt; 'user_mail_tokens', 'sanitize' =&gt; FALSE)).

The function user_mail_tokens() is described in the documentation as:


  Token callback to add unsafe tokens for user mails.
  
  This function is used by the token_replace() call at the end of _user_mail_text() to set up some additional tokens that can be used in email messages generated by user_mail().


The code used by _user_mail_text() to call that callback is the following one.

// We do not sanitize the token replacement, since the output of this
// replacement is intended for an e-mail message, not a web browser.
return token_replace($text, $variables, array('language' =&gt; $language, 'callback' =&gt; 'user_mail_tokens', 'sanitize' =&gt; FALSE));


The Token module is not necessary to replace tokens, in Drupal 7. The code to replace tokens is part of the Drupal 7 core code; the Token module in Drupal 7 defines extra tokens that Drupal core modules don't define.