@Andrew_Lowe Yes! I have confirmed with engineering:
The reason why it looks as if it keeps working is because the logged in user already has a current session running, and the logic for the magic link reads that, and associated the user logged in to simply return them to the webapp