Alright, I chatted with the dev team about this. The multi-login is simply a series of redirects. See, for security reasons, a browser can’t set cookies on another domain; so to make this work, the browser has to actually go to that domain to set the cookie, so you will see the URLs flash in the browser’s URL bar.
If you are developing a site and don’t want that URL to be included, simply leave it out of the config.php multi-login list.
So, what you’re seeing is totally normal - sorry it took so long to figure that out; it was mostly a misunderstanding of what the concern was.