A contact's hosted preference-page URL, as returned by
MillionSend.Contacts.preferences_link/2. contact is the contact id. The
link is a signed, contact-scoped capability with no expiry: anyone holding it
can change that contact's preferences, so hand it only to the contact.