Changes to return a TokenAndUrl instance than just the URL when
generating an authentication request. This makes sure that developers
just need to store one object and not use the logic of supplying the
right param at verification.