Clarify that controller auth isn't automatic

[skip ci]