Is it possible for the browser to indicate an address other than the one we already expect? Should the user be forced to re-auth?