Use authenticate URL instead of authorize URL