I'm guessing the HN web server has a particularly narrow interpretation of the HTTP/1.1 spec:
For compatibility with HTTP/1.0 applications, HTTP/1.1
requests containing a message-body MUST include a valid
Content-Length header field unless the server is known
to be HTTP/1.1 compliant. If a request contains a
message-body and a Content-Length is not given, the
server SHOULD respond with 400 (bad request) if it
cannot determine the length of the message, or with
411 (length required) if it wishes to insist on
receiving a valid Content-Length.
In this case Lynx knows HN is a HTTP/1.1 server and so doesn't bother with Content-Length. That makes the server code a more complicated so I guess it just hasn't been coded.
If you mean logging in via clicking a link in an email then it is too much of a security risk. Think of all the places that URL can end up in: browser history, bookmarks, etc.
It works for password reset because the window of opportunity is small (just a few minutes) and it is a once-only operation (visiting the URL again should not reset your password again).
In this case Lynx knows HN is a HTTP/1.1 server and so doesn't bother with Content-Length. That makes the server code a more complicated so I guess it just hasn't been coded.