Or: ask the user to use the same browser and check that cookies match / "sanitize" gmail adresses