Sign in with the challenge flow, then we verify the role before showing any admin surface.
Use the same challenge endpoint as the main app.