the redirect was cause by having
`<link rel="authorization_endpoint" href="https://fran.io/api/auth" />`
instead of
`<link rel="authorization_endpoint" href="https://fran.io/api/auth/index.php" />`