diff --git a/tljh/configurer.py b/tljh/configurer.py
index 4dc32c1d7..52b78abd8 100644
--- a/tljh/configurer.py
+++ b/tljh/configurer.py
@@ -182,6 +182,10 @@ def update_auth(c, config):
     be set.
     """
     tljh_auth_config = config['auth']
+
+    # FIXME: Make sure this is something importable.
+    # FIXME: SECURITY: Class must inherit from Authenticator, to prevent us
+    #        being used to set arbitrary properties on arbitrary types of objects!
     c.JupyterHub.authenticator_class = tljh_auth_config['type']
 
     for auth_key, auth_value in tljh_auth_config.items():