notes on auth flow