flesh out auth flow