Add notes re auth