authentication flow without a federated login