Checking auth headers works now
Add some explanatory comments