Interesting approach. I have seen the token approach being used also in phauxth library. My only objection/concern with this is that it creates longer and uglier urls to send in a email. Apart from masking the url with a button is there any other cure?
iex(1)> Phoenix.Token.sign(MyAppWeb.Endpoint, "random", 5)|> String.length