add todo notes about data and auth