auth_request now returns redirect urls instead of response objects