Add a note to the auth docs about withCredentials