How would a phishing attack against a website which doesn't use passwords, only magic links, be performed?