How session tokens and Google social login work, what can go wrong when an account is compromised, and how to reduce risk without giving up convenience.