add question about user-backend

New bugs should also contain some info about the user-authentication
I'd prefer to document this independent of the database