better flow for authentication