added 'flow' to step2oauth