update auth flow