Use Authenticate URL instead of Authorize URL