auth flow working