Validate a magic-link token from the request and sign the user in, returning no content on success.