Authenticating with One-Time Tokens or Links