How about two states for authentication: "light" and "fully authenticated" If I click to the site via link in email, I get to "light" mode. This allows me to s

How about two states for authentication: "light" and "fully authenticated" If I click to the site via link in email, I get to "light" mode. This allows me to see things. Other actions can require "fully authenticated" mode and the transition light => fully requires me to enter my password. With password reset emails I'd like to have a basic security question (one that I can pick myself).