Thanks, finally some thoughts about how to solve the issue. In particular, email based login/account reset is the main important use case I can think of.
Do bots that follow links in emails (for whatever reason) execute JS? Is there a risk they activate the thing with a JS induced POST?
Do bots that follow links in emails (for whatever reason) execute JS? Is there a risk they activate the thing with a JS induced POST?