Added comments about user's privileges and authorization workflow and implementation