An issue exists where unauthenticated attackers can control the hosts of emailed links. This is achieved by supplying `x-authorizer-url` gRPC metadata to the gRPC port or using a `Grpc-Metadata-X-Authorizer-Url` header via the REST gateway. This allows attackers to capture reset or magic-link tokens, potentially leading to account takeover.