directed auth should re-direct

pop-ups are blocked without a click event