Unsubscribe — confirmation page. The actual unsub fires on POST.

Background: Outlook / Hotmail / corporate-firewall gateways prefetch every URL in inbound email (including the unsubscribe link) for security scanning. A GET that immediately unsubscribed produced silent phantom opt-outs — confirmed via timing analysis (multiple sub-second hits on the same email from the same IP).

Now GET renders a confirmation page; the unsub only fires when a human clicks the button (POST). Mail-gateway prefetchers don't submit forms.