I might have been over thinking sharing. If I add an Out Of Band (OOB) portion, then it all becomes much easier.

• User A clicks "Share List"
• Server generates a unique id and stores it along with the list id, user id, and timestamp
• Server gives User A a link containing the id
• User A sends the link to user B OOB
• User B uses the link
• Sever uses the id to look up the list and:
  • Adds User B to the users for the list
  • Deletes the id
  • Notifies User A