Web Identity without third-party cookies