One click, no sign-in required.

An unsubscribe link that makes someone log in first is an unsubscribe link that gets a spam complaint instead, and one complaint costs the sending domain that every other physician's mail goes through. The token only ever turns mail OFF, so the worst a leaked one can do is stop an email.

kind stops one stream instead of all of them, so the link at the foot of a pin notification can mean "stop telling me about pins". Without it the behaviour is byte for byte what it always was, and it has to stay that way: every link in mail already sent carries no kind, and a link that came to mean less than it said when it was sent would be the worse bug.