Added general docs + return 401 (not 403) when authentication fails