I would be happy to whitelist the sites with which I use oauth/openid to log in. If I didn't, it would still work; I'd just have to reauthenticate once for every site.
you could even just whitelist oauth/openid to work across all sites.
Nitpick: OAuth doesn't require cookies. You can track someone through the state parameter in the redirect url.