Update auth.md

Clarify authN and authZ