Break-glass sign-in for local and development deployments
(COLLABD_TOKEN). Production uses GitHub above. The token is
stored in a secure, httpOnly cookie for this browser session.
Why sign in before installing the app?
Installing on GitHub first has nowhere to land: collabd binds the installation to
your account using a session and a one-time nonce that have to exist before the
redirect. Sign in first and the install returns you here, already bound.