social authentication security #386
Description
We need a config option like allowedOrigin: ['https://wlk.yt/'] for use in the social signup feature, to prevent sending semi-private data (only the avatar in this case) to unknown clients.
Originally posted by @goto-bus-stop in #265 (comment)