[doc] document the authorization hook