Add some review comments as TODOs for deferred authentication