This is the best approach to the problem, though it doesn't satisfy the implied(?) requirement that new devices should auto-authenticate seamlessly. You have to

This is the best approach to the problem, though it doesn't satisfy the implied(?) requirement that new devices should auto-authenticate seamlessly. You have to keep track of all of the cookies, of course, but there is comparatively little risk in letting previously authenticated machines (with an expired session) perform automatic login via a token in an email. The OP should point this out in his article.