Generate a fresh secret at end of OAuth, and require that secret on login.

Ensures that only the user who completed the OAuth flow can log in over DDP.