cornsnow IdP login+consent. Start a flow at /oauth2/auth.