full URL is passed after authentication