Ensure it isn't possible to link accounts with a request that starts at
the identity provider, as this would allow a malicious group or IdP to
link accounts for arbitrary users tricked into visiting that IdP.