Token-based authentication using GOV.UK SSO