some tweaks to auth code flow