Add "Mocking authentication" best practice

[kettanaito]

Would be good to have

1. When to start mocking (mock the auth provider call, not the callback itself).
2. Pieces of advice.