social authentication security

[goto-bus-stop]

We need a config option like allowedOrigin: ['https://wlk.yt/'] for use in the social signup feature, to prevent sending semi-private data (only the avatar in this case) to unknown clients.

Originally posted by @goto-bus-stop in #265 (comment)