change email oauth flow control to make even more sense