Here is some interesting info on throwies from evilmadscientist.com
[Connecting a 1.7 V LED directly to a CR2032]
Wait-- 107 mA?!--‽
Yes, this is reproducible. (That is to say, we
wasted used up another battery just because we didn't believe it either.) But holy cow anyway.
"And they said this was safe?" There are a couple of legitimate concerns here. Lithium coin cells aren't designed to source nearly that much power-- and aren't lithium batteries a fire hazard? And why does my LED-- rated for 25 mA continuous current survive this? I've certainly seen enough LEDs destroyed by overcurrent, and this one was over 25 mA for ten minutes solid. But, and perhaps against my better judgement, I do believe that this actually is safe in practice. With all of the throwies and similar things out there -- don't forget the keychain flashlights -- they just don't seem to be exploding or catching on fire. (Breaking, falling apart, running out of photons, yes-- but those modes of failure are usually not as dangerous.)
So.... Do you need a resistor? No, not really. As we said, it seems to be reasonably safe without one. Should you use a resistor? Yeah you should, if you want a red, yellow, or orange LED to last more than a day or so. So you can solder a resistor in place, but that somewhat defeats the purpose of easy to assemble throwies.
So to make it not a total pain-in-the rear to add resistors, here's a way to do it without soldering: just twist it.