Clarify auth in docs slightly.