My general thoughts, and personal opinion on the matter is as follows.I have seen several permutations of this phenomenon where the license in the distribution is different from that on the project’s web site.
I am fairly certain that the license included in the distribution governs the user who downloads and installs software from that distribution. Otherwise there would be no certainty or consistency for end users about what license terms they are bound by, particularly if they receive the distribution via CD or some other media not downloaded and no files within the distribution give notice that any “later” or other version of a license applies. However, if a file in the distribution gives notice that current license terms are on the project web site, the end user may be obligated to check there before accepting and using the software. Then the issue of the generic GPL link comes into play. The generic link to the GPL license that so many projects use probably needs to be reevaluated and clarified by each project lead on a project-per-project basis. This is an additional burden on project leaders, probably unintentional on the part of the Free Software Foundation, but each project needs to determine whether they want to be pointing their GPL link to the GPLv3 or the GPLv2. I think that unless an end user is given notice within the project distribution that they need to go to the project web site for license terms or that some other license or version of a license applies, the end user can only be bound by what they find in the distribution.This is a tricky issue, and I’d be interested to see what, if anything, the FSF has to say about it.