When the page first loads it ends up passing the keycloak redirect token stuff to the API /trove/access/rules/new&state=...