An unverified email could match admin_emails/user_emails on providers that
let users set their own email. Only an explicit false is rejected; providers
that omit the claim are still trusted. Document the behavior.
Reported-by: Zachariah Mithani <zachariah@aplosai.com> (AploSec)
* oauth: bind state to browser session
Bind each authorization state to a short-lived HttpOnly cookie so callback URLs cannot create sessions in browsers that did not initiate login.
Use per-state cookie names to preserve concurrent flows and reject callback origins that cannot receive the host-only cookie.
* oauth: preserve explicit proxy redirects
Keep browser-state binding usable when TLS terminates before Neko while still rejecting callback hosts that cannot receive the login cookie.
Miroslav Šedivý
Seungwon Lee