added note about not using authenticated user