Update README for XeroOAuth2Sample

Author: MJMortimer

XeroOAuth2Sample/README.md

@@ -5,7 +5,7 @@ The use case of our app is to sign users in user Xero Sign In and retrieve and d
 This sample is an extension of the [XeroSignInSample](../XeroSignInSample)
 
 **Pre-requisite**: 
-- This sample is a .NET Core 2.2 application, so you'll need to install [.NET Core SDK 2.2 or above](https://dotnet.microsoft.com/download).
+- This sample is a .NET Core 3.1 application, so you'll need to install [.NET Core SDK 3.1 or above](https://dotnet.microsoft.com/download).
 - You may want to read through Xero's [OAuth2.0 documentation](https://developer.xero.com/documentation/oauth2/overview) to familiarise yourself with the OAuth2.0 flow.
 
 ## Getting started with this sample.
@@ -140,10 +140,10 @@ private static Func<TokenValidatedContext, Task> OnTokenValidated()
 
 Now that we've configured how we want our users to be authenticated, we've got to enable and enforce it.
 
-Looking at the *configure* method in the same `Startup` class, you'll see the following line of code. **Note**: it's important that this line of code exists before the `UseMvc` line so that the request pipeline can enforce authentication prior to routing the requests to your controllers.
-
+Looking at the *configure* method in the same `Startup` class, you'll see the following line of code. **Note**: it's important that these lines of code exist in this order between the `UseRouting` and `UseEndpoints` lines so that the request pipeline can enforce authentication prior to routing the requests to your controllers.
 ```
 app.UseAuthentication();
+app.UseAuthorization();
 ```
 
 Looking at the *OutstandingInvoices* route on our [HomeController](XeroOAuth2Sample/Controllers/HomeController.cs), you'll see that we've set the route to require authorized users using the `Authorize` attribute. This route does not care which scheme (*XeroSgnIn*/*XeroSignUp*) was used when a user was previously authenticated, and will use the default scheme (which you'll remember we set earlier) to authenticate the user if the user is not authenticated.