Use a one-time token issued by the site owner.
Ask the site owner to issue a 30-minute token. It works once and revokes every existing session.
