When a user has forgotten their password, how to let them set a new one? A user has forgotten her password, so she uses the 'forgotten password' function. She receives an email with one-time login, and proceeds to edit her profile to set a new password.

But that form requires the old password in order to reset password. A catch 22 situation?
Same problem here. My site had an action set to direct to the homepage on login. This helped me a lot to identify it. My solution was to disable the action an set a destination parameter by GET in my template to redirect user to the homepage on login. "/user?destination=/"