We'll send a one-time link. No password.
Dev: the link is logged to your server console — no real SMTP wired yet.