> This is unsafe.

How so? The only info we reveal here is the username and account provider.

> It assumes we do not have multiple sessions.

Yes. But doesn't the code already implicitly assumes that, by treating auth.persona as our definitive user account?

> I think it's trying to assert that since we were logged in already, this could only have been triggered by the code auth plugin. No?

No. it's testing oldValue to determine whether we are just starting up the system (when oldValue will be null), or this is really a change event (when oldValue will be defined).

On change events, we assume that we have logged in. (Since in this branch of the if, newValue is non-empty.)