add some extra notes for load testing and revisiting authorization