It seems three would be possible, but really it is the same thing as 2 since you would probably still want to include a random url parameter so you could verify they actually got the email and didn't know to go to the specialized login page directly.


