Add changeset and docs.

Signed-off-by: Joon Park <joonp@spotify.com>

docs/tutorials/backend-to-backend-auth.md

@@ -22,13 +22,14 @@ resulting value.
 node -p 'require("crypto").randomBytes(24).toString("base64")'
 ```
 
+**NOTE**: For ease of development, we auto-generate a key for you if you haven't
+configured a secret in dev mode. You _must set your own secret_ in order for
+backend-to-backend authentication to work in production.
+
 Requests originating from a backend plugin can be authenticated by decorating
 them with a backend token. Backend tokens can be generated using a
 `TokenManager`, which can be passed to plugin backends via the
-`PluginEnvironment`. The `TokenManager` provided in new Backstage instances
-generated by `create-app` is a stub, which returns empty tokens and accepts any
-input string as valid. To enable backend-to-backend authentication, you'll need
-to instantiate a new one using the secret from your config instead:
+`PluginEnvironment`.
 
 ```diff
 // packages/backend/src/index.ts
@@ -42,8 +43,7 @@ function makeCreateEnv(config: Config) {
 
   const cacheManager = CacheManager.fromConfig(config);
   const databaseManager = DatabaseManager.fromConfig(config);
-- const tokenManager = ServerTokenManager.noop();
-+ const tokenManager = ServerTokenManager.fromConfig(config);
++ const tokenManager = ServerTokenManager.default({ config, logger: root });
 ```
 
 With this `tokenManager`, you can then generate a server token for requests: