I was thinking more about using basic auth and passing the token in the header:
<useremail>/token:<token>