Fix up #2461

Cleans up the optional auth a bit, and explains usage a little more.

Adds disclosure details and a link to a forthcoming blog post.