change email oauth flow control to make more sense