By: Michael Lynch <git@mtlynch.io>
Merge master into email auth branch Preserve the magic-link login flow while carrying over the applicable login hardening from master. The login POST handler now fails malformed form bodies explicitly and rejects invalid next paths before sending login email.