When viewing the login email in pure text, the & in the login url are &. That breaks the login URL.
&
&