add note about user authentication