yeah sloppy, it sets a session token; session-setting URLs should be hard to share, not easy. thank god it asks for a password before you can do anything bad, b

yeah sloppy, it sets a session token; session-setting URLs should be hard to share, not easy. thank god it asks for a password before you can do anything bad, but the e-mail exposure in the settings flow isn't great. fortunately the x_id param isn't sequential.