auth flow updated