authorize method initiates auth flow and handles callback