send an expiring unique nonce token to their email address. when testing period is over you could implement another solution.