UI-driven auth rather than browser-driven