authentiation control flow now works correctly