several changes on auth flow