Passwordless signin via link generated by api

[sam (Sam Saffron)]

If they get a user api key like our mobile app does then it solves both issues in one go, its a tricky protocol but was designed for this exact problem.