fix authentication flow