Open the url in a browser (so the user can authenticate at the AS), and store state to use in next call.