Signin via new email yields Sign-up-like email but doesn't create session

I found that if I try to sign-in via unregistered email I still get an account but I don't get a session when I enter the code. I think this is a bug.

How to reproduce:

create a new project via bb -e '(load-string (slurp "https://biffweb.com/new-project.clj"))'
bb dev
Go go localhost:8080/signin (not signup but signin)
enter an email
enter code
Result is HTTP 303 to http://localhost:8080/signin?error=not-signed-in

So I didn't get a session to sign in with and it created the user.

The email link has SignUp and SignIn header and texts:

TO: new@aaaa.com
SUBJECT: Sign up for My Application

We received a request to sign in to My Application using this email address. Enter the following code to sign in:

981163

This code will expire in three minutes. If you did not request this code, you can ignore this email.

So the subject is "sign UP" and the content is "sign IN".

So one of these have to be changed to either redirect into /app or the UI has to crash and say that this user doesn't exist :thinking_face:

jacobobryant / biff

Signin via new email yields Sign-up-like email but doesn't create session #167