security doesn't check on the server once we've done that the first time.
temp login works from emailed link.