Cross-Device Flows: Security Best Current Practice