improve documentation about how auth() is used