new authentication flow, and new middleware