more progress in the auth flow