title: Best practices for token authentication in web apps?
body: <p>I want to make a simple REST web app, where the user interact with the objects through links in an email. The links have a token that can be used to authenticate a user without a username and password, like the ones that are usually used to reset a password.</p>
  
  <p>What are the best practices for such a login-less, token-based authentication system?</p>