Best Practice for Password Reset in ASP.NET MVC

I'm looking to emulate the password reset flow from www.live.com. That is (skip email option for now):

1) Screen asking/confirming the username

2) Ask reset method (account verification or email reset)

3) Gather account info and verify it

4)向用户提供密码重置输入。

So I was looking for any tips on how to do this a proper way. I planned on having each 'step' post back to the same action and build up the model as I go (putting properties/fields into hidden inputs or regular inputs based on the step I was on). Then on step 4, I'd re-verify the account information (just in case someone tried to hack and post directly to step for with username and new password).

这一切都将通过SSL完成,我能看到的唯一缺点是,对于步骤4,我将在隐藏输入中呈现用户的机密问题答案,以便在完成密码重置之前再次提交/验证。

Is this the proper way to implement this screen or are there some security holes I'm not seeing?