then maybe for auth: login link > password > one time code ? hard to be 100% confident