initial backend login flow