++ project authentication-flows

since flows are relevant not only for oauth-srv, but also for the client
app (that manages users), we need this code in a common place