add some notes about future improvements for auth..

NOTES.md

@@ -3,6 +3,16 @@ Issues to address
 
 If app crashes, won't sync w/ board status in database.
 
+Authentication.  Likely should attach an expiration policy to access
+tokens generated by an ssh key.  This way an ssh key can be passwordless
+for automation, and the cli could do:
+bitelab auth; bitelab reserve board; <dothings>; bitelab release board; bitelab revoke
+
+where auth fetches an access token via ssh, and revoke, revokes the token
+as it is no longer needed.  This either allows a "one time" access token where
+the user can provide a passphrase to get the token at auth time, or limited
+valid time access tokens such that if they were leaked, they would quickly
+expire.
 
 CONNECT proxy
 =============