You need to block the transfer of credentials between different private browsing windows. Within a private browsing window, it makes sense to pass your credentials between different tabs, but not between different windows. After all, that's the idea ...
