What happens under the hood when a client performs an OAuth authentication flow with a financial institution through Plaid?