docs: add clarification about IAM token service endpoint

Author: padamstx

Authentication.md

@@ -198,6 +198,15 @@ form:
 - URL: (optional) The base endpoint URL of the IAM token service.
 The default value of this property is the "prod" IAM token service endpoint
 (`https://iam.cloud.ibm.com`).
+Make sure that you use an IAM token service endpoint that is appropriate for the
+location of the service being used by your application.
+For example, if you are using an instance of a service in the "production" environment
+(e.g. `https://resource-controller.cloud.ibm.com`),
+then the default "prod" IAM token service endpoint should suffice.
+However, if your application is using an instance of a service in the "staging" environment
+(e.g. `https://resource-controller.test.cloud.ibm.com`),
+then you would also need to configure the authenticator to use the IAM token service "staging"
+endpoint as well (`https://iam.test.cloud.ibm.com`).
 
 - ClientId/ClientSecret: (optional) The `ClientId` and `ClientSecret` fields are used to form a 
 "basic auth" Authorization header for interactions with the IAM token server. If neither field 
@@ -309,6 +318,15 @@ One of `IAMProfileName` or `IAMProfileID` must be specified.
 - URL: (optional) The base endpoint URL of the IAM token service.
 The default value of this property is the "prod" IAM token service endpoint
 (`https://iam.cloud.ibm.com`).
+Make sure that you use an IAM token service endpoint that is appropriate for the
+location of the service being used by your application.
+For example, if you are using an instance of a service in the "production" environment
+(e.g. `https://resource-controller.cloud.ibm.com`),
+then the default "prod" IAM token service endpoint should suffice.
+However, if your application is using an instance of a service in the "staging" environment
+(e.g. `https://resource-controller.test.cloud.ibm.com`),
+then you would also need to configure the authenticator to use the IAM token service "staging"
+endpoint as well (e.g. `https://iam.test.cloud.ibm.com`).
 
 - ClientId/ClientSecret: (optional) The `ClientId` and `ClientSecret` fields are used to form a 
 "basic auth" Authorization header for interactions with the IAM token service. If neither field