Update the auth window process to be two steps so that the referrer header is always set