Do you think it is an acceptable idea to allow people to sign in by sending them a link with a random string linked to that user? i.e. if someone has that link then they are trusted to log in. What do you think?
I'm sure there are levels of access that can be granted to slowly introduce users to your app.
Hearing 'sign in without logging in' makes me cringe, but I can see why you would want to do this. I hear what Joachim said that it really is no worse that being able to recover password via email, but it seems there might be more opportunity for a single email to go astray (or accidentally forwarded) than an entire account to be hijacked.
I expect that some people won't be too happy about having to dig the link out of their mail, but that's fixable by allowing user/password as well.
Usually capabilities have a time-limit and sometimes a blacklist.