You're creating a secret token. Both the administrator and the browser should be made aware of this. The administrator, so that they don't send it to the user v

You're creating a secret token. Both the administrator and the browser should be made aware of this. The administrator, so that they don't send it to the user via an unsecure method (Tweet it publicly), the browser so that it shows warnings if the site is somehow served without ssl or is compromised. If it's something like a password, it should be treated like a password. Why shouldn't you use type=password for that?