Added comments about auth checks done before begin_request()