New, simpler approach. And it is working. If we need TOTP support, some additional work is needed to get reasonable implementation based on PicketBox TOTP login module.