Bad handling of concurrent client activations
If the client receives an activation from the Browser while a previous one is not yet completed. A second "Card required" dialog pops up correctly. But they are not handled correctly in the following.
A simple solution would be to prohibit activation (by returning a meaningful error to the Browser) while an authentication is still in progress.