replace Authorization service with Flow