The far side of the OAuth redirect is a page load with a session cookie, which looks like every later page load of the same session. signin-form.ts leaves a mark on the way out so the return can be told apart and counted once. Players are identified by a salted SHA-256 of their DID, never the DID. The salt ships in the bundle, so it makes the id inert rather than secret; an opaque id minted by the API is the version that would resist someone trying.