email notifications & query strings with authentication

Does this controller still work like it should? I'm not sure how `format.html` is implemented, but my guess is that it just returns a HTTP response, so it probably needs to be the last line of this `if` block? Or there might be some Rails magic going on here, I'm not really sure