Clarify auth types, add more to note