you could even just whitelist oauth/openid to work across all sites.