Sign in securely

Use password auth or a magic link. Password auth stays available so the web app does not depend on email links alone.