magic-link as now 2 modes: - invitation: long TTL (24), no challenge - passwordless login: short TTL (10min), cookie challenge to ensure that user goes back to same browser (no man in the middle capturing email)
imortant on security side: magic link will be enabled only for users who don't have password nor OIDC