this is fine here, but should we think about pointing to the conceptual section for this in the new authentication guide

(this strikes me as the kind of thing where we'd merge this in and make a ticket to do it after the authentication guide gets merged.)