Use acr instead of amr to specify auth method