Clarify responsibilities in Authentication controller concern