doc: document authentication and permissions