I don't understand quite what this comment refers to. is this actually a TODO to add a response code in addition to the `authenticated` boolean?