I would use the same implementation as a password reset token - generate a hash and store it with a time-to-live - but I would probably be less lenient with the

I would use the same implementation as a password reset token - generate a hash and store it with a time-to-live - but I would probably be less lenient with the TTL (although as has been discussed, not for any real good reason).