move auth notes out of readme and into a wiki page