middlewares/auth: document all functions better