struggling to figure out how login flow should work