authorization flow implemented, though not fully tested (backend missing)