Added notes to token validation code

Author: marcusca10

Microsoft.SCIM.WebHostSample/Startup.cs

@@ -41,7 +41,8 @@ public void ConfigureServices(IServiceCollection services)
             {
                 // Development environment code
                 // Validation for bearer token for authorization used during testing.
-                // This is not meant to replace proper OAuth for authentication purposes.
+                // NOTE: It's not recommended to use this code in production, it is not meant to replace proper OAuth authentication.
+                //       This option is primarily available for testing purposes.
                 services.AddAuthentication(options =>
                 {
                     options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
@@ -65,7 +66,11 @@ public void ConfigureServices(IServiceCollection services)
             }
             else
             {
-                // Azure AD token validation code
+                // Leave the optional Secret Token field blank
+                // Azure AD includes an OAuth bearer token issued from Azure AD with each request
+                // The following code validates the Azure AD-issued token
+                // NOTE: It's not recommended to leave this field blank and rely on a token generated by Azure AD. 
+                //       This option is primarily available for testing purposes.
                 services.AddAuthentication(options =>
                 {
                     options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;