Add section about authentication in the API draft spec