working on username/password flow