Example 2: Indirect SCA via third-party login page