Not signed in yet. Since the browser state might have an anchor
token which we want to capture and carry through the auth process
we send back JavaScript now to capture that, and do the real work
of redirecting to the authentication area.
