done, also added a note about removing legacy auth