Something along these lines might work: Generate an AES encryption key, known to https://example.org and https://example.net. On the initial request by the user to https://example.org, the server encrypts timestamp|authentication token using the key, then responds with a 301 rediect to https://...