Exchange a one-time login token for a browser session. On success the user is redirected (302) to Omnisend with session cookies set.

This endpoint must be called from the user's browser (e.g. via a form POST) so that cookies are stored in the browser context.