Add note about why PCS is included inside auth.go