When I tested this case (ExB app and embedded app are from same self-domain organization - not using the extra queryparams), the authentication is shared and there is no 2nd login prompt. But for cross domain the authentication is not shared eventhough I used "arcgis-auth-origin" and "arcgis-auth-portal" params.