More gracefully communicate to users when they've clicked a magic sign in URL that's expired

[jsonin]

When I ask SP for my login token, the email that gets spit back to me after the request has the token and a URL... the URL doesn't work (the token does).

[fermion]

@jsonin the URL works fine for me in development and in production 🤔

[jsonin]

This seems to have... vanished.

[fermion]

For posterity, I suspect the email links being clicked were > 10 minutes old. After that point the magic URLs / tokens become invalid and won't work. We could/should detect this case and handle it more gracefully than, say, a sign in attempt that has no passwordless session waiting for it.