[keycloak-user] Clarification regarding authentication flows