The UAG authentication flow