[auth] more flow