diff --git a/inc/outbox.php b/inc/outbox.php
index d29fc1e..7058206 100644
--- a/inc/outbox.php
+++ b/inc/outbox.php
@@ -2,6 +2,7 @@
 /*
 When an Activity is received (i.e. POSTed) to an Actor's outbox, the server must:
 
+  0. Make sure the request is authenticated
   1. Add the Activity to the Actor's outbox collection in the DB
   2. Deliver the Activity to the appropriate inboxes based on the received Activity
        This involves discovering all the inboxes, including nested ones if the target