Plays the role of a partner domain. The product runs below as a cross-site iframe.
The product only tells the parent a coarse loggedIn boolean. The key never leaves the iframe. A malicious parent cannot read the credential.