Incosisten behaviour in cross-origin-authentication flow