v0.36.0 doc sweep update

internal/sink/http/http.go

@@ -452,7 +452,6 @@ func (h *HTTPSink) handleStream(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("X-Accel-Buffering", "no")
 	w.WriteHeader(http.StatusOK)
 
-	// Connected event with metadata, parity with fasthttp sink
 	info, _ := json.Marshal(map[string]any{
 		"client_id":   strconv.FormatUint(id, 10),
 		"session_id":  sess.ID,
@@ -621,10 +620,11 @@ func (h *HTTPSink) GetStats() sink.SinkStats {
 // handlers; absent when auth is disabled
 type identityKey struct{}
 
-// authMiddleware gates every endpoint on the policy: a client certificate
-// or a bearer token. The rejection carries no detail: the status endpoint
-// already exposes host, port, and throughput counters, so a refusal should
-// not add the shape of the policy on top of that.
+// authMiddleware gates stream and status on the policy: a client
+// certificate, a bearer token or, behind a proxy, the session cookie. The
+// rejection carries no detail: the status endpoint already exposes host,
+// port, and throughput counters, so a refusal should not add the shape of
+// the policy on top of that.
 func (h *HTTPSink) authMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ident, status, err := h.auth.AuthorizeRequest(r)

internal/sink/http/http_test.go

@@ -373,7 +373,7 @@ func TestProxiedStreamSessionKeepsTheProxy(t *testing.T) {
 
 // The constructor refuses what it cannot serve: the login pages outside
 // scram's proxy mode, a viewer without the login page, a path under /auth, and
-// a path ServeMux or a URL would not take literally, which panicked at Start.
+// a path ServeMux or a URL would not take literally.
 func TestUnservableOptionsAreRefused(t *testing.T) {
 	scram := map[string]any{"type": "scram", "credentials_file": scramCredentials(t)}
 	pki := testutil.NewPKI(t, "viewer-01")