Use a persistent identification cookie even when the "remember me" checkbox isn't used. By themselves, neither the cookie nor the email nonce are enough to aut

Use a persistent identification cookie even when the "remember me" checkbox isn't used. By themselves, neither the cookie nor the email nonce are enough to authenticate. But if you have both at once, you are authenticated. This will cover almost everybody, it will have almost no false positives (forwarding an email to somebody who uses the same browser on the same computer is the only one I can think of off the top of my head), and the fallback of requiring explicit authentication in other cases seems acceptable.