tweak auth flow