more generally, is there a very clear and consistent pattern to follow for auth0 login? i've seen a lot of different approaches and i'm finding it a bit confusing. in particular, auth0 authorization for existing users is easy and works well (it's easy to reason about) but it's murkier when it comes to creating a new user on the fly.