Add comments asking about login API.

I believe it would be nicer if instead of simply passing back a 401, a
page would pass back the authentication endpoint as a redirect and then
push the 401.  This would allow the token to be returned on any request
that wasn't authenticated.