xhr auth: better wording