Begin the grant: persist a one-time state token and hand back the URL.
Successful Response
Where to send the operator to grant access.