- Data-protection keys are encrypted (AES-256-GCM, key derived from the
server secret) before they reach the DataProtectionKeys table.
- /link only follows local return paths and keeps the form when a
signed-in visitor has an identity waiting to be linked.
- A failed sign-out says so instead of reloading as if it worked.
Alexa