Improve documentation of the authentication infrastructure.

It's also authenticating the user if it's not.