Don't use `user.Identities` (these come from the claim principal object); use `user.GetProviderIdentitiesAsync` instead (which return the Zumo provider identities which we need).