Auth docs should call out that a persistent storage is necessary

[heyitsaamir]

Atleast for SSO, it looks like we depend on IStorage to store the key and later use it for validation (tokenExchange, tokenPost). This should be explicitly called out in the docs.

Not sure where else the necessity for persistent storage is, but that should all be explicitly called out in the docs.