tidy up auth flow logic