Unsubscription is identified by subscriber cid. This effectivelly allows only the recipient of the email to unsubscribe. This addresses issue #221.

I also scraped the "auto" parameter which automatically submits the unsubscription form when the link is clicked in a campaign email. Instead, I introduced the
unsubscription options ONE_STEP, ONE_STEP_WITH_FORM, TWO_STEP, TWO_STEP_WITH_FORM. The options without "_WITH_FORM" shall behave like when called with "auto".
This functionality is to come. Currently it behaves as ONE_STEP_WITH_FORM.

views/subscription/partials/subscription-unsubscribe-form.hbs

@@ -1,20 +1,13 @@
 <form method="post" id="main-form" action="/subscription/{{lcid}}/unsubscribe">
     <input type="hidden" name="_csrf" value="{{csrfToken}}">
     <input type="hidden" name="campaign" value="{{campaign}}">
-    <input type="hidden" name="cid" value="{{cid}}">
+    <input type="hidden" name="ucid" value="{{ucid}}">
 
     <div class="form-group">
         <label for="email">{{#translate}}Email address{{/translate}}</label>
-        <input type="email" name="email" id="email" placeholder="" value="{{email}}" autofocus required>
+        <input type="email" name="email" id="email" placeholder="" value="{{email}}" readonly>
     </div>
 
     <button type="submit" style="position: absolute; top: -9999px; left: -9999px;">{{#translate}}Unsubscribe{{/translate}}</button>
 </form>
 
-{{#if email}}
-    {{#if autosubmit}}
-        <script>
-            document.getElementById('main-form').submit();
-        </script>
-    {{/if}}
-{{/if}}

views/subscription/web-unsubscribe.mjml.hbs

@@ -3,9 +3,6 @@
         <mj-text mj-class="h3">
             {{#translate}}Unsubscribe{{/translate}}
         </mj-text>
-        <mj-text mj-class="p">
-            {{#translate}}Enter your email address to unsubscribe from:{{/translate}} {{title}}
-        </mj-text>
         <mj-text>
             {{> subscription_unsubscribe_form}}
         </mj-text>