Instead of putting a password hash in the URL (Not a very good idea) why not generate a random string when the user is created and just put this (and possibly the username) in the URL.
Then, check that the string in the URL matches the one in the database when they visit the page.