Hacker News Reader

You can use such tokens to disable email notifications, and still not provide complete access to the account, though.

This seems like a good compromise.

Allow immediate access for convenience in some cases, but restrict that access to a specific task until login.

Yes, but the scope of access would have to be severely limited, to the point where's there's no real sense in doing it, e.g. you'd have to prompt for settings change, but also probably read/write access to private messages, wall, etc... It'd be a lot of work with little return (the more return, the less security).

Yeah, good points.

AFAIK CAN-Spam only applies for unsolicited emails, so a newsletter from a service you opted into does not need to abide by it. May be I'm mistaken.

> CAN-SPAM mandates 1-click opt-out

Actually it requires one-click or two-click. And not for transactional emails.