updated doc to explain authenticated api requests