Note docs on geoserver auth; also some typos