Oh, it's just for email. That makes sense. Seems pretty weak since it relies on the user noticing the absence of a security feature. I'd probably prefer the em

Oh, it's just for email. That makes sense. Seems pretty weak since it relies on the user noticing the absence of a security feature. I'd probably prefer the emails have no links and train people to never click from an email. Make them log in the same way they usually do to take any actions.