Explain SPNEGO more

app/controllers/omniauth_kerberos_spnego_controller.rb

@@ -13,6 +13,16 @@ class OmniauthKerberosSpnegoController < ApplicationController
       return
     end
 
+    # When the browser is Kerberos-aware, this response will make it try to
+    # get a Kerberos ticket and present it to us via an SPNEGO token.
+    # 
+    # When the browser does not know Kerberos, or if it tried to
+    # authenticate with Kerberos but failed, it shows the special 'Kerberos
+    # denied' 401 page to the user.
+    # 
+    # We cannot redirect the user to the sign-in page because we do not know
+    # when the browser has given up.
+    #
     headers['Www-Authenticate'] = spnego_challenge
     render 'errors/kerberos_denied.html.haml', layout: 'errors', status: 401
   end