Since it takes arguments, it triggers the CSRF warning, but it's a
readonly page and it's common to tell someone "Here's a copy of the
email that went out" - so let people visit it directly.