added better error feedback for authentication

* Auth.pm now returns a user and an error message, so the feedback to the user can be more verbose
* fixed missing timeout verification in Auth.pm webkey check
* added source code documentation