The current implementation of process_challenge doesn't reliably authenticate when logging in via e-mail address using a client_secret. It will yield a: "An error occurred (NotAuthorizedException) ...