Renders /unsubscribe?token=, for anyone holding a digest's link. It asks before turning the digest off, since mail scanners open every link in an email, then posts the token to POST /api/unsubscribe.