try to understand auth_flow.c