laid out basic auth flow