Bring back comment (mislaid in commit a5b2fff6) that explains why HTTP Basic Auth check uses `&`; it is useful for learners and mitigates `&` being accidentally replaced with `&&` one day.