email notifications & query strings with authentication

Agreed - this method is trying to do a lot. You can try refactoring the conditions into private predicate methods in the controller with descriptive method names. But what will probably work as a better alternative is creating a service object to get all the logic out of the controller. The logic here is pretty complicated as well, but I'm sure it can be refactored to be to a lot easier to understand on a read through! Feel free to ask me about anything.