diff --git a/src/Logger/DatabaseHandler.php b/src/Logger/DatabaseHandler.php
index e74d557..c8c278c 100644
--- a/src/Logger/DatabaseHandler.php
+++ b/src/Logger/DatabaseHandler.php
@@ -11,18 +11,13 @@ use Monolog\Level;
 use Monolog\LogRecord;
 
 /**
- * Monolog handler that persists log entries to the database.
+ * Persists log entries to the database.
  *
- * Writes log records to the log_entry table, replacing message placeholders
- * with context values. Includes channel, context, and extra data for auditing.
- * Only processes INFO level and above to avoid storing debug messages.
- *
- * The write goes through the DBAL connection rather than the EntityManager on purpose. A log record
- * can be emitted at any point, including halfway through somebody else's unit of work, and an
- * EntityManager flush would write out whatever that unit of work has pending so far — which is how
- * a half-built User once reached the database with a NULL password. Staying out of the UnitOfWork
- * also keeps logging alive after a failed flush has closed the EntityManager, which is exactly when
- * there is something worth logging.
+ * The write goes through DBAL rather than the EntityManager on purpose. A log record can be emitted
+ * halfway through somebody else's unit of work, and an EntityManager flush would write out whatever
+ * that unit of work has pending — which is how a half-built User once reached the database with a
+ * NULL password. Staying out of the UnitOfWork also keeps logging alive after a failed flush has
+ * closed the EntityManager, which is exactly when there is something worth logging.
  *
  * Reads still go through the LogEntry entity and its repository.
  */
diff --git a/src/Security/BpnAuthenticator.php b/src/Security/BpnAuthenticator.php
index 36ec5fb..f7a7f33 100644
--- a/src/Security/BpnAuthenticator.php
+++ b/src/Security/BpnAuthenticator.php
@@ -32,8 +32,7 @@ use Symfony\Component\Security\Http\Util\TargetPathTrait;
 /**
  * Authenticates users against the BPN API.
  *
- * Validates credentials via BPN's getPersonalData endpoint and creates or updates
- * local User entities. Passwords are stored encrypted with RSA for subsequent API calls.
+ * The password is kept, RSA-encrypted, because every later BPN call needs it again.
  *
  * BusPro owns the whole role set and the hotel codes: both are synced on every login, in both
  * directions, so anything the CRM no longer reports is withdrawn here. What the CRM claims is
@@ -65,7 +64,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         $email = trim($request->request->getString('_username'));
         $passwordPlain = trim($request->request->getString('_password'));
 
-        // Very lame hashing applied here as required by BPN
+        // BPN requires md5, not a real hash
         $password = md5($passwordPlain);
 
         try {
@@ -179,8 +178,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         $targetPath = $this->getTargetPath($request->getSession(), $firewallName)
             ?? $this->urlGenerator->generate('app_account');
 
-        // When redirecting to admin from an HTMX request, force a full page navigation
-        // to avoid layout issues between front- (hx-boost) and backend
+        // A full load avoids hx-boost layout issues
         if ($request->headers->has('HX-Request') && str_contains($targetPath, '/admin')) {
             return new HxRedirectResponse($targetPath);
         }