The opening summary said Telegram, Email and anonymous auth "would work
everywhere". That holds only with AUTH_SEND_JWT_HEADER set, and the widget's
own cookie is Secure, so the path is HTTPS-only and bounded by ALLOWED_HOSTS
besides. The sentence now states those conditions. What happens without the
flag is two separate things, whether sign-in succeeds in the frame and whether
it survives a reload, and the body below already separates them.
The other two are older: a stray backtick after "work on any domain", and
"expect" for "except" in a bullet whose neighbour already says except.
Related to #2218
UmputunandGitHub
5f439cf1d5