first working redirect to login, confirm trust and back to RP workflow