Comment by tjkrusinski

You can also go password-less. Sessions are started with a URL sent to email. The session only begins if the cookie + signed URL match.