auth, now with normal flow