Explain why we have an object_access_hook at all
Don't log authentication events

It was easy to implement, but it was never on the list of requirements.
But it doesn't really fit in any more, so we get rid of it.