[auth] flow tweaks