I think it's probably better to allow the option for single sign-on instead (i.e. Facebook or Twitter). It's just as easy for the user, essentially the same dif

I think it's probably better to allow the option for single sign-on instead (i.e. Facebook or Twitter). It's just as easy for the user, essentially the same difficulty level for the developer, and seemingly much more secure than sending tokens through email. Of course, it does have a couple of disadvantages (not all users have Facebook/Twitter accounts or would feel comfortable with you having access to them, plus you're partially dependent on an external service), but I think for most applications SSO would be preferable to authentication tokens.