written doc for auth

can be reused.