...
New URL should be generated and user should be able to cope it (3.1).
...
How to invalidate token which leaked?
If in some case generated token leak and a person without permissions has access to calendar, the user can invalidate the current token. To invalidate token, user need to click in link “here” (4.1).
...