Added instructions on how to require authentication on a controller policy.

This took me a second to figure out so it may be worth it to add to the README.