[simonw]

I think what I want here is a token which expires if it hasn't been used for six months.