auth should return Hapi error on unknown token, fix comments