From #5 (comment)
We added an additional step where the app sending the authentication request hosts a manifest file with information about the app. As part of processing the authentication request, the identity provider downloads the manifest from the app. You can see the code here: https://github.com/blockstack/blockstack.js/blob/master/src/auth/authBrowser.js#L84