start phase out remaining insecure ?hash= from #photoai MVP and replace with login by email token that is used once and then discarded, we already had session cookies but ?hash= was still legacy working