Add note about form-encoded authentication_token.