Someone commented on the original post:

"Or provide a single use single action token that performs one function, like confirm friend. Security doesn’t need to be all or nothing."

For extra security this token can be one time useable only.