Yeah, app tracking isn't the same as what's been requested. Mobile OS version is critical because those versions have different web browsers that need to be catered for.
I couldn't agree more, passwords should be completely transparent to admins. A clickable link with a token instead would be both more secure and convenient as the plaintext password wouldn't need to be relayed to the individual.