Only if existing sessions are invalidated. Otherwise, magic login links like this have a problem: - Attacker signs up with victim's email address and is immedi

Only if existing sessions are invalidated. Otherwise, magic login links like this have a problem: - Attacker signs up with victim's email address and is immediately logged in (signup usually triggers a login/session creation). The session could last forever - Victim tries to sign up, but it doesn't work, because the account is already registered. Victim assumes they forgot about them signing up already and requests a login-link/token. Victim logs in using the method and adds sensitive data to the account. - Attacker session is still active, attacker can read victim's information.