Can't connect blog with "Someone may be trying to trick you" error

Hi,

We have a WP multisite network (v 4.7.4) with Jetpack (v 4.8.2) which we are trying to connect with the Google Docs Add-on. The authentication flow seems ok and editors/admin can:

1. Click Add Wordpress Site
1. Select the correct site from list on https://public-api.wordpress.com/oauth2/
1. Click Approve

This takes users to the login page e.g. https://altc.alt.ac.uk/blog/wp-login.php with query string parameters e.g. action=jetpack_json_api_authorization&redirect_to=... but the following error is displayed:

> Someone may be trying to trick you into giving them access to your site. Or it could be you just encountered a bug :). Either way, please close this window.

We do use [a SAML login](https://github.com/ktbartholomew/saml-20-single-sign-on) but even when this is disabled we get the same error message. Happy to dig further if you let me know what to look for

Start by reproducing the listed OAuth flow on a WordPress 4.7.4 multisite with Jetpack 4.8.2, first with SAML disabled, and inspect the wp-login.php redirect and query parameters. Done means the Google Docs Add-on completes site authorization without showing the “Someone may be trying to trick you” error.

Written by the indexing model from the issue text.