782e5864

By: Michael Lynch <git@mtlynch.io>

Preserve used-token errors when session lookup fails

A failed session lookup cannot establish that the current user owns the
replayed magic link. Return the original used-token error instead of replacing
it with the session error.