User opt-in/opt-out should probably be via POST requests, not GET, even though they don't have any payload data.