Update auth flow

[backkem]

Update the auth flow to match w3c/openscreenprotocol#294.

[backkem]

#4 fixes most of this; the remainder is pending clarification in w3c/openscreenprotocol#359