spotifycsrf: clean up flow