def token
    # NOTE: We don't use Tokens::Base here because we don't want users to abuse
    #       API tokens to build permanent login links.
    #
    # This repeats the code in Token::Base.authenticate, because we need the
    # token.
    if token = Tokens::OneTime.with_code(params[:code]).first
      auth = token.authenticate
    else
      auth = :invalid
    end

    if auth.is_a? Symbol
      error_text = bounce_notice_text auth
      respond_to do |format|
        format.html do
          redirect_to new_session_url, flash: { alert: error_text,
              auth_redirect_url: session_url }
        end
        format.json { render json: { error: auth, text: error_text } }
      end
    else
      self.set_session_current_user auth
      home_with_token token
      unless performed?
        respond_to do |format|
          format.html { redirect_to session_url }
          format.json do
            user_data = current_user.as_json
            if current_user.class.include_root_in_json
              user_data = user_data['user']
            end
            render json: { user: user_data, csrf: form_authenticity_token }
          end
        end
      end
    end
  end
def token
    # NOTE: We don't use Tokens::Base here because we don't want users to abuse
    #       API tokens to build permanent login links.
    #
    # This repeats the code in Token::Base.authenticate, because we need the
    # token.
    if token = Tokens::OneTime.with_code(params[:code]).first
      auth = token.authenticate
    else
      auth = :invalid
    end

    if auth.is_a? Symbol
      error_text = bounce_notice_text auth
      respond_to do |format|
        format.html do
          redirect_to new_session_url, flash: { alert: error_text,
              auth_redirect_url: session_url }
        end
        format.json { render json: { error: auth, text: error_text } }
      end
    else
      self.set_session_current_user auth
      home_with_token token
      unless performed?
        respond_to do |format|
          format.html { redirect_to session_url }
          format.json do
            user_data = current_user.as_json
            if current_user.class.include_root_in_json
              user_data = user_data['user']
            end
            render json: { user: user_data, csrf: form_authenticity_token }
          end
        end
      end
    end
  end
GET /session/token/token-code