getting closer to having a working auth flow