DOC: A bit more documentation.

src/main/java/caosdb/server/accessControl/SelfValidatingAuthenticationToken.java

@@ -147,7 +147,13 @@ public abstract class SelfValidatingAuthenticationToken extends Principal
   @Override
   public abstract String toString();
 
-  /** Implementation specific version of a peppered checksum. */
+  /** Implementation specific version of a peppered checksum.
+   *
+   * For secure opration, implementing classes must make sure that the pepper is actually used in
+   * calculating the checksum and that the checksum can not be used to infer information about the
+   * pepper.  This can be achieved for example by using the {@link calcChecksum(final Object... fields)}
+   * method.
+   */
   public abstract String calcChecksum(String pepper);
 
   /** No credentials (returns null), since this token is self-validating. */
@@ -214,7 +220,7 @@ public abstract class SelfValidatingAuthenticationToken extends Principal
       case "S":
         return SessionToken.parse(array);
       default:
-        throw new AuthenticationException("Could not parse the authtoken string.");
+        throw new AuthenticationException("Could not parse the authtoken string (unknown type).");
     }
   }