auth flow & fixed crud