fix auth flow