Document @authenticated's behavior around query parameters.

Closes #998.