[xyzzy_plugh]

You could, or you could just add a few round trips in the email thread and perform a handshake with the token HMAC encoded.