Unsubscribe an email recipient (issue

Public, unauthenticated. Also the target of RFC 8058 one-click unsubscribe (List-Unsubscribe-Post: List-Unsubscribe=One-Click), which POSTs here with no human interaction — the token lives in the path, so no request body is required. Idempotent: a second POST still returns the success page. A well-formed token's own traffic never charges the rate limiter — RFC 8058 one-click requests for many unrelated recipients commonly share one mail-provider egress IP, and a genuinely valid unsubscribe is never throttled by that shared traffic alone. But the lookup is skipped, and this returns 429, if the caller's IP or the process-wide backstop is already exhausted by PRIOR invalid requests — checked before the store call — so a well-formed, genuinely valid token can still be temporarily rejected once that budget is already spent. Only a confirmed-invalid token (or malformed input, rejected up front) actually charges the limiter, 60/hour per caller IP plus a process-wide backstop across every IP.