login flow research / best practices / factchecking the llm 'security notice' v nostr developer writings and implementations in major clients