Step 2, get user to login, code, ask bearer_token