basic auth flow