Comment explaining www-auth format