add authentication and permission docs