It sends the email but the codes never work. We probably need to make a db entry to verify a link vs sending a2fa code that has a time limit.