improved authentication flow, removed some console.log