It seems like this calls for a two-pronged approach. If you've been logged in to their site from that browser in that account, then the link from the e-mail sh

It seems like this calls for a two-pronged approach. If you've been logged in to their site from that browser in that account, then the link from the e-mail should auto-log in (unless it's been disabled for that account). Otherwise, it should prompt to allow an actual login as usual. This way, you can forward an e-mailed link, and unless they happen to have logged as you already, they don't get into your account. This probably means a significant amount of attention to detail to exactly which cookies are set, how long they live, and what they mean, but it sounds worth the effort.