include a one-shot login link in the code email