Signing in lands where you were going

If a page asked you to sign in, you should land back on that page afterwards. Email and password did this; the social buttons and the magic-link route did not, and dropped you on the dashboard or the login form instead. All of them honour the destination now.

Magic links last thirty minutes rather than five, which was too short for anyone who reads their email in batches, and they land you on your dashboard directly instead of on an in-between page that then jumped again. Finishing a password reset leaves you signed in rather than asking you to sign in with the password you just set. Every link in these emails points at designed.org.

One fix behind the scenes matters more than it sounds. Members who had signed in by Google or by a link could see their name in the header while some actions — deleting an account was the one reported — silently did nothing, because half of the session was missing. That half is picked up automatically now, on every page.