Document how authorize handles unverified challenges