The popup should not contain any OIDC code; it can just pass anything to the parent. `auth.login` could pass the URL instead of redirecting.