A signed-in session crosses two of our domains in a URL fragment, and one consumer handles both producers

Sign-up happens on munchable.app, the app runs on app.munchable.app, and no cookie crosses that boundary. The handoff, why the tokens ride in the fragment, the replaceState that cleans up, and the chooser that offers Premium while a browser is still the context.