#2214's two TLS cases both sign in anonymously, so anonymous is the only one
of the three named flows exercised in a third-party frame. Email is covered
over http and never embedded, and Telegram is covered nowhere and cannot be
until #2208 makes the API base URL configurable. The expectation that all
three behave alike rests on the client-side writer keying off X-JWT and not
off the provider, which is an inference and now reads as one.
Dmitry Verkhoturov
864cde68c8