add some comments around authentication method
log auth errors