Why not make them 2 use tokens?
Not quite as secure, but way better than never expires?
Not quite as secure, but way better than never expires?
Gmail may fetch the page but wont run the js on it.
Edit: this works for situations when spam filters fetch the links as soon as the mail arrives.
Comment about a form and PUT/POST is good - it will work by standards in any browser, even when gmail starts executing javascript. Add auto-submit on top javascript if preferred.