diff --git a/app/mailers/user_mailer.rb b/app/mailers/user_mailer.rb
index 76c10305..69479a17 100644
--- a/app/mailers/user_mailer.rb
+++ b/app/mailers/user_mailer.rb
@@ -20,10 +20,11 @@ class UserMailer < ApplicationMailer
 
   def got_new_comment(comment, request_for_comment, commenting_user)
     # TODO: check whether we can take the last known locale of the receiver?
+    token = AuthenticationToken.generate!(request_for_comment.user)
     @receiver_displayname = request_for_comment.user.displayname
     @commenting_user_displayname = commenting_user.displayname
     @comment_text = comment.text
-    @rfc_link = request_for_comment_url(request_for_comment)
+    @rfc_link = request_for_comment_url(request_for_comment, token: token.shared_secret)
     mail(
       subject: t('mailers.user_mailer.got_new_comment.subject',
         commenting_user_displayname: @commenting_user_displayname), to: request_for_comment.user.email
@@ -31,10 +32,11 @@ class UserMailer < ApplicationMailer
   end
 
   def got_new_comment_for_subscription(comment, subscription, from_user)
+    token = AuthenticationToken.generate!(subscription.user)
     @receiver_displayname = subscription.user.displayname
     @author_displayname = from_user.displayname
     @comment_text = comment.text
-    @rfc_link = request_for_comment_url(subscription.request_for_comment)
+    @rfc_link = request_for_comment_url(subscription.request_for_comment, token: token.shared_secret)
     @unsubscribe_link = unsubscribe_subscription_url(subscription)
     mail(
       subject: t('mailers.user_mailer.got_new_comment_for_subscription.subject',
@@ -43,10 +45,11 @@ class UserMailer < ApplicationMailer
   end
 
   def send_thank_you_note(request_for_comments, receiver)
+    token = AuthenticationToken.generate!(request_for_comments.user)
     @receiver_displayname = receiver.displayname
     @author = request_for_comments.user.displayname
     @thank_you_note = request_for_comments.thank_you_note
-    @rfc_link = request_for_comment_url(request_for_comments)
+    @rfc_link = request_for_comment_url(request_for_comments, token: token.shared_secret)
     mail(subject: t('mailers.user_mailer.send_thank_you_note.subject', author: @author), to: receiver.email)
   end
 
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 521b2939..780cb87d 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -601,8 +601,6 @@ en:
           <br>
           Sie finden ihre Kommentaranfrage hier: %{link_to_comment} <br>
           <br>
-          Falls Sie beim Klick auf diesen Link eine Fehlermeldung erhalten, dass Sie nicht berechtigt wären diese Aktion auszuführen, öffnen Sie bitte eine beliebige Programmieraufgabe aus einem Kurs heraus und klicken den Link danach noch einmal.<br>
-          <br>
           Eine Übersicht Ihrer Kommentaranfragen gibt es hier: %{link_my_comments} <br>
           Alle Kommentaranfragen aller Benutzer finden Sie hier: %{link_all_comments} <br>
           <br>
@@ -618,8 +616,6 @@ en:
           <br>
           You can find your request for comments here: %{link_to_comment} <br>
           <br>
-          If you receive an error that you are not authorized to perform this action when clicking the link, please log-in through any course exercise beforehand and click the link again. <br>
-          <br>
           An overview of all your comments can be accessed here: %{link_my_comments} <br>
           All comments of all participants are available here: %{link_all_comments} <br>
           <br>
@@ -641,8 +637,6 @@ en:
           <br>
           Sie finden die Kommentaranfrage hier: %{link_to_comment} <br>
           <br>
-          Falls Sie beim Klick auf diesen Link eine Fehlermeldung erhalten, dass Sie nicht berechtigt wären diese Aktion auszuführen, öffnen Sie bitte eine beliebige Programmieraufgabe aus einem Kurs heraus und klicken den Link danach noch einmal.<br>
-          <br>
           Danke, dass Sie anderen Nutzern von CodeOcean helfen!
           <br>
           Diese Mail wurde automatisch von CodeOcean verschickt.<br>
@@ -657,8 +651,6 @@ en:
           <br>
           You can find the request for comments here: %{link_to_comment} <br>
           <br>
-          If you receive an error that you are not authorized to perform this action when clicking the link, please log-in through any course exercise beforehand and click the link again. <br>
-          <br>
           Thank you for helping other users on CodeOcean!
           <br>
           This mail was automatically sent by CodeOcean. <br>
@@ -676,8 +668,6 @@ en:
           <br>
           Sie finden die Kommentaranfrage hier: %{link_to_comment} <br>
           <br>
-          Falls Sie beim Klick auf diesen Link eine Fehlermeldung erhalten, dass Sie nicht berechtigt wären diese Aktion auszuführen, öffnen Sie bitte eine beliebige Programmieraufgabe aus einem Kurs heraus und klicken den Link danach noch einmal.<br>
-          <br>
           Wenn Sie keine weiteren Benachrichtigungen zu dieser Anfrage erhalten möchten, klicken Sie bitte hier: %{unsubscribe_link}
           <br>
           Diese Mail wurde automatisch von CodeOcean verschickt.<br>
@@ -692,8 +682,6 @@ en:
           <br>
           You can find the request for comments here: %{link_to_comment} <br>
           <br>
-          If you receive an error that you are not authorized to perform this action when clicking the link, please log-in through any course exercise beforehand and click the link again. <br>
-          <br>
           If you don't want to be notified about further comments, please click here: %{unsubscribe_link}
           <br>
           This mail was automatically sent by CodeOcean. <br>
diff --git a/spec/mailers/user_mailer_spec.rb b/spec/mailers/user_mailer_spec.rb
index b9b14bab..762ad8f7 100644
--- a/spec/mailers/user_mailer_spec.rb
+++ b/spec/mailers/user_mailer_spec.rb
@@ -60,4 +60,122 @@ describe UserMailer do
       expect(mail.body).to include(reset_password_internal_user_url(user, token: user.reset_password_token))
     end
   end
+
+  describe '#got_new_comment' do
+    let(:user) { create(:learner) }
+    let(:token) { AuthenticationToken.find_by(user: user) }
+    let(:request_for_comment) { create(:rfc_with_comment, user: user) }
+    let(:commenting_user) { InternalUser.create(attributes_for(:teacher)) }
+    let(:mail) { described_class.got_new_comment(request_for_comment.comments.first, request_for_comment, commenting_user).deliver_now }
+
+    it 'sets the correct sender' do
+      expect(mail.from).to include(CodeOcean::Application.config.action_mailer[:default_options][:from])
+    end
+
+    it 'sets the correct subject' do
+      expect(mail.subject).to eq(I18n.t('mailers.user_mailer.got_new_comment.subject', commenting_user_displayname: commenting_user.displayname))
+    end
+
+    it 'sets the correct receiver' do
+      expect(mail.to).to include(request_for_comment.user.email)
+    end
+
+    it 'includes the correct URL' do
+      expect(mail.body).to include(request_for_comment_url(request_for_comment))
+    end
+
+    it 'includes the correct authentication token' do
+      expect(mail.body).to include(token.shared_secret)
+    end
+
+    it 'sets a new authentication token' do
+      expect { mail }.to change(AuthenticationToken, :count).by(1)
+    end
+
+    it 'sets a non expired authentication token' do
+      mail
+      expect(token.expire_at.future?).to be(true)
+      token.expire_at -= 8.days
+      expect(token.expire_at.future?).to be(false)
+    end
+  end
+
+  describe '#got_new_comment_for_subscription' do
+    let(:user) { create(:learner) }
+    let(:token) { AuthenticationToken.find_by(user: user) }
+    let(:request_for_comment) { create(:rfc_with_comment, user: user) }
+    let(:subscription) { Subscription.create(request_for_comment: request_for_comment, user: user) }
+    let(:from_user) { InternalUser.create(attributes_for(:teacher)) }
+    let(:mail) { described_class.got_new_comment_for_subscription(request_for_comment.comments.first, subscription, from_user).deliver_now }
+
+    it 'sets the correct sender' do
+      expect(mail.from).to include(CodeOcean::Application.config.action_mailer[:default_options][:from])
+    end
+
+    it 'sets the correct subject' do
+      expect(mail.subject).to eq(I18n.t('mailers.user_mailer.got_new_comment_for_subscription.subject', author_displayname: from_user.displayname))
+    end
+
+    it 'sets the correct receiver' do
+      expect(mail.to).to include(subscription.user.email)
+    end
+
+    it 'includes the correct URL' do
+      expect(mail.body).to include(request_for_comment_url(subscription.request_for_comment))
+    end
+
+    it 'includes the correct authentication token' do
+      expect(mail.body).to include(token.shared_secret)
+    end
+
+    it 'sets a new authentication token' do
+      expect { mail }.to change(AuthenticationToken, :count).by(1)
+    end
+
+    it 'sets a non expired authentication token' do
+      mail
+      expect(token.expire_at.future?).to be(true)
+      token.expire_at -= 8.days
+      expect(token.expire_at.future?).to be(false)
+    end
+  end
+
+  describe '#send_thank_you_note' do
+    let(:user) { create(:learner) }
+    let(:token) { AuthenticationToken.find_by(user: user) }
+    let(:request_for_comments) { create(:rfc_with_comment, user: user) }
+    let(:receiver) { InternalUser.create(attributes_for(:teacher)) }
+    let(:mail) { described_class.send_thank_you_note(request_for_comments, receiver).deliver_now }
+
+    it 'sets the correct sender' do
+      expect(mail.from).to include(CodeOcean::Application.config.action_mailer[:default_options][:from])
+    end
+
+    it 'sets the correct subject' do
+      expect(mail.subject).to eq(I18n.t('mailers.user_mailer.send_thank_you_note.subject', author: request_for_comments.user.displayname))
+    end
+
+    it 'sets the correct receiver' do
+      expect(mail.to).to include(receiver.email)
+    end
+
+    it 'includes the correct URL' do
+      expect(mail.body).to include(request_for_comment_url(request_for_comments))
+    end
+
+    it 'includes the correct authentication token' do
+      expect(mail.body).to include(token.shared_secret)
+    end
+
+    it 'sets a new authentication token' do
+      expect { mail }.to change(AuthenticationToken, :count).by(1)
+    end
+
+    it 'sets a non expired authentication token' do
+      mail
+      expect(token.expire_at.future?).to be(true)
+      token.expire_at -= 8.days
+      expect(token.expire_at.future?).to be(false)
+    end
+  end
 end