magic link authentication for phx.gen.live

[SteffenDE]

No description provided.

[SteffenDE]

This change is necessary because we want to disconnect existing LiveView connections when a password is changed (we already invalidate the sessions). This is not happening at the moment, which could be a security risk. The problem with the old setup (changing the password in the LiveView) is that we clear the tokens when changing the password, so this is also the moment where we need to broadcast disconnects for all old sessions. Broadcasting here would break the flow though, because the current LiveView would be disconnected before it has a chance to actually handle the trigger_submit. Instead of doing a "disconnect everything except me" which would require us to know the session token in the LiveView, we instead move the actual password change mechanism to the controller and only validate here.