fix doc hint about auth token