Update authentication documentation for RO support

Rewrote the authlib documentation to clarify bits and pieces of how we
do authentication and authorization.

Fixed a few things in the backend logic documentation as well.

Part of #438.
Merge branch '438-read-only-documentation'