working on username password flow