authentication via external browser