#4 : support auth-flows + spring-security