Authentication step with hidden iframe