How is a magic url really any different from a magic login cookie in this case? Yeah, I guess you can't revoke it, but what's the difference if the new cookie/url is equally unguessable?