Add magic-link Portal sessions for managed users

[ezekg]

It would be useful in cases where a license is created for a user, but that user doesn't have a password set (i.e. a managed user). This would allow users to recover their licenses, since keys can be lost but email is less likely to be lost.

Related to the session authn work in #863.

[ezekg]

This should be configurable at the account-level, since not all accounts are going to want users to access the Portal.