I can guess they'd so something like a unique URL that expires quickly and checks the user agent/headers/other stuff. Like all of this kind of stuff, it won't be bulletproof, but it'll be good enough. I'm sure I'm missing some other option that's better, though.