Stands in for the player: mints a nonce, launches the sign-in page, and runs the same origin/type/nonce checks the player will run. Deploy this to a different site than the sign-in page to exercise third-party storage.