Return authorization URL, don't make a call