OAuth2 flow should start at the custom login app instead of UAA directly