Yeah, requiring logging in to unsubscribe is probably illegal per CAN-SPAM, but I'm not sure. That type of flow does end with me marking every email I have ever received from the brand as SPAM though. My personal favorite is an example of a company that locked my account and refuses to reopen it. People who run these companies are such idiots that it's literally unbelievable.