Ensure the requester of MagicLink is the one to use it

[udiudi]

It's not a critical vulnerability, but I think it should be addressed to tighten the authentication process.

Simple Reproduction Steps

I'll use Fizzy's seed data as an example:

1. david@37signals.com signs-in, has a screen to write the code (and an email is sent).
2. jason@37signals.com signs-in, has a screen to write the code. If jason@37signals.com writes david@37signals.com's code (for whatever security breach), he's signed-in as david@37signals.com as a result.

The Riskier Scenarios

This vulnerability can allow phishing attacks - as we usually see in the realm of two-factor auth ("You got a code in your email, can you send it over?").

Not very critical - but should be addressed, IMO.

The Fix

Ensuring that the user who requests a magic link is the only one who can use it to sign-in with a session based check session[:pending_auth_email].

Proposed PR here