splash auth flow