diff --git a/modules/user/user.pages.inc b/modules/user/user.pages.inc
index 6cdc30c341bf855405015265e57ddcc30fd689c6..2547b7bc8879e00c8969dcfacd7363ac4fbd8ce6 100644
--- a/modules/user/user.pages.inc
+++ b/modules/user/user.pages.inc
@@ -89,13 +89,13 @@ function user_pass_reset(&$form_state, $uid, $timestamp, $hashed_pass, $action =
     $current = REQUEST_TIME;
     // Some redundant checks for extra security ?
     $users = user_load_multiple(array($uid), array('status' => '1'));
-    if ($timestamp < $current && $account = reset($users)) {
+    if ($timestamp <= $current && $account = reset($users)) {
       // No time out for first time login.
       if ($account->login && $current - $timestamp > $timeout) {
         drupal_set_message(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'));
         drupal_goto('user/password');
       }
-      elseif ($account->uid && $timestamp > $account->login && $timestamp < $current && $hashed_pass == user_pass_rehash($account->pass, $timestamp, $account->login)) {
+      elseif ($account->uid && $timestamp >= $account->login && $timestamp <= $current && $hashed_pass == user_pass_rehash($account->pass, $timestamp, $account->login)) {
         // First stage is a confirmation form, then login
         if ($action == 'login') {
           watchdog('user', 'User %name used one-time login link at time %timestamp.', array('%name' => $account->name, '%timestamp' => $timestamp));
diff --git a/modules/user/user.test b/modules/user/user.test
index e12294a3a3895c41ff8ee591b274047768e932c6..028d06e079406f099bd4aa77182e4bc59f1d9e90 100644
--- a/modules/user/user.test
+++ b/modules/user/user.test
@@ -57,7 +57,6 @@ class UserRegistrationTestCase extends DrupalWebTestCase {
 
     // Login using password reset page.
     $url = user_pass_reset_url($user);
-    sleep(1); // TODO Find better way.
     $this->drupalGet($url);
     $this->assertText(t('This login can be used only once.'), t('Login can be used only once.'));