Hacker News Reader

You sure your friend hadn't previously logged in to her FB on whatever browser your email happened to open things to?

Yes. She's never been on or near this machine. I have no idea of her credentials, and nor would I want to.

token string in the URL?

Correct.