document why authenticated is set for viewbuyableinfo permission