Design secure authentication flows for web apps