SPA with Auth0.js and Management API – consent required