working auth flow