Bug? User is logged in immediately upon call to WebAuth's authorize