Managing Caching When Using Three-Legged Auth for SignNow Integrations

I'm currently working on updating an integration with the SignNow document signing platform wherein for non-owner users a three-legged auth cycle is needed in order to submit a new document for signing with the APIs. The integration is added to a NetSuite account, and I'm launching the three-legged auth page via JavaScript in a browser pop-up using window.open(). I'm using this method so that I can have SignNow use an externally available Suitelet as a callback which can then create a basic page with some JavaScript on it that can send the code SignNow generates back to the opener in order to kick off the integration functionality. I already have a inter-window messaging function built to handle the cross-domain issues presented by having an externally accessed Suitelet communicate with a logged-in session. However, I found if I make a mistake with entering credentials in the SignNow page, the whole thing gets cached and I can't retry to enter credentials again until I go in and clear everything out of the cache, otherwise it just flows through without any user interaction, continuing to use the incorrect credentials.

This is the base URL for the SignNow three-legged auth with some placeholders:

https://app.signnow.com/authorize?client_id={CLIENT_ID}?response_type=code&redirect_uri={CALLBACK_URL}

And this is how I'm making the window opening call:

var targetURL = signNowURL.replace("{CLIENT_ID}", escapedClientId).replace("{CALLBACK_URL}", escapedCallbackURL;
window.open(targetURL, "_blank", "height=950,width=700");

So far one of the the only things I have thought to try is to attempt to make the URL unique, because every time the window is launched, it will always be the same URL with the same parameters. However, the endpoint will not allow any parameters that they do not want and will error out the page. One way I have found this out is that I tried to open a Suitelet in the pop-up which then redirected to the SignNow URL. However, the redirect added "&whence=" to the URL upon executing the redirect, and the SignNow page displayed an error about the unwanted parameter and no login credential fields.

Is there a better way to launch a pop-up like this where caching can be disabled, or is there some window.open() feature value that can be used? I'd hate to inconvenience users over something like this since the SignNow page doesn't return to the login page if the credentials fail. Would replacing "_blank" with a unique value, such as a UUID/GUID, help the problem?