doc improvements around auth