Where the caller goes to approve this authorisation.
Blocks until the caller has approved at url, then returns the principal, whose user id is the one the authenticator resolves.