Just an FYI - if you put URLs that include tokens in public view - as in that email - people can type those into a browser and sign whatever it is as if they are you.