summary

removes the removeSession() call in initialize() when url based login fails, preserving valid sessions when users click a magic link more than once

problem

when a user clicks a magic link twice, the second click fails because the token is already consumed. the old code called removeSession() on this failure, which destroyed the valid session from the first click, logging the user out unexpectedly.

solution

don't call removeSession() on url login failure. a failed login attempt should never invalidate an existing valid session.

the original comment claimed this matchedverifyOtp, signUp, signInWith behavior, but none of those methods call removeSession() on error.

related

closes #1685