Apparently so do Google and Github according to the other comments in this thread. Seems like a potential design flaw in these SSO implementations.