fixed: auth flow