[buraksarica]

Please just ask for that token and email over SSL. It's that simple. No need to risk people to lower user acquisition ramp.

[xyzzy_plugh]

You could, or you could just add a few round trips in the email thread and perform a handshake with the token HMAC encoded.