add docs on authorization callback