Passwordless authentication via HTTP