refactor authentication flow