worked on spa-eque login flow, abandoned for now, back to simulated spa with actual redirects