fixed auth flow