4 ms·

1) The special token is much better idea. I don't feel comfortable giving out any passwords to anyone, (almost) ever.