Never share login links with a password in the URL. Credentials are only sent in the sign-in request body.