How do I set a time limit on a URL?

Question

Here is some background.
I am writing an application in Apex 4.2 for our company's Help Desk.  The first phase of the app is to reset a user's Oracle password.  The user will call the Help Desk to reset their password.  The Help Desk Specialist will send an email to the user with a URL directing them to a page in the app where they can type in a new password.
For security reasons, I have the following requirements for the URL sent to the user via email:
The URL must only be valid for 15 minutes or less
The URL cannot be used more than once from a specific email
The URL must become invalid if it is changed
How can I achieve this?  The page must be a public page as the end user does not have access to the application.

Answer 1

I've done something similar creating time-limited application access tokens which could work in this instance.
On creation of the e-mail/reset request create a token and insert it into an audit table along with the request time.  The token could be a a UID from SYS_GUID.
The hyperlink can set an item on the page with the token, on page load the record for the token is checked for validity;
not > 15 mins old
hasn't been used already
Either upon resetting the password, or on the initial page load an application process sets a flag against the token that it's been used so it can't be accessed again.
This approach can meet 1 and 2 but not 3, and I'm not sure how you can prevent a user changing the URL.  By choosing a very complicated token such as a GUID it makes it very hard for the user to manually guess another valid (and unused) URL. 
Kes