add a umbrella dev config
slightly change the authentication flow: the client shall pass via the app instead of directly github