POST /auth/challenge