diff --git a/ayanova/devdocs/todo.txt b/ayanova/devdocs/todo.txt
index a818fa41..835e6ec4 100644
--- a/ayanova/devdocs/todo.txt
+++ b/ayanova/devdocs/todo.txt
@@ -73,6 +73,7 @@ CURRENT ITEM:
 
 # DANGER DANGER - can make two users with the same login.  that's not cricket!
 	- also User model, login and password are not set to required
+	- also auth route with dubious expectation about salt being only necessary differentiator and collection returned from login which should be one only now after this change
 
 Fix existing integration tests
 Add tests as I go while adding all the structure of the workorder and all ops