pre-approved links out to auth clients