add auth docs to readme