...
After they click allow - they need to:
refresh the site again
...
try to login again
at which point they should be able to succeedsuccessfully login.
Future logins won’t prompt them to redo this for some time. I believe Safari requires the user to have direct access to the original site every 30 days. (This is what the popup “My Authorization” page does for them.