Auth docs should call out that a persistent storage is necessary

Atleast for SSO, it looks like we depend on IStorage to store the key and later use it for validation (tokenExchange, tokenPost). This should be explicitly called out in the docs.

Not sure where else the necessity for persistent storage is, but that should all be explicitly called out in the docs.

Start by locating the authentication documentation and the IStorage usage around tokenExchange and tokenPost. Document that SSO requires persistent storage for the key used during validation, and note any other flows found to have the same requirement. Done means the relevant docs explicitly state these persistent-storage requirements.

Written by the indexing model from the issue text.