We have done one time use query string codes at the end of a URL sent to a user email address or as a text message to allow for this...