The authentication mechanism actually uses cookies, that don't expire for a long time, to authenticate the user. Private links come in when the user wants to log in via a device which he does not usually use.