authentication workflows: almost there