Improve documentation of the authentication infrastructure.

I spoke too soon: This particular method only checks if a user is authenticated and returns `null` if not. There is also a version of `checkAuth()` which takes a username and a password. One of the patches marks that one as deprecated because it is (almost) unused. The same patch also removes the only use I could find.