using an xhr call to pull auth url from server