What are the best practices to log into nostr apps on mobile without risking spilling your nsec?