The Reset Password link does ask for both a new password and token, but you can skip that part of the form when you request a new password initially. On the first attempt, insert the username and email, fill out the captcha, and press "Reset Password". You should receive an email to click on a link to request a new password with a token filled out already after clicking the link from your email account page. Once you put your new password and confirmation of that password in, repeat what you did in your first attempt, and that should change the password successfully.
As for why the form has a token and new password field, I don't know why. It works though, and I admit that it's not so direct because it says one thing in the first line, then it says this in the second line: "If you do not have a reset token, do not input a password or token." So just pay attention to the second line and ignore the first line. [Please input your account username, e-mail address, desired new password and reset token.]