chore: update wording of inline comments

src/Security/BpnAuthenticator.php

@@ -32,8 +32,7 @@ use Symfony\Component\Security\Http\Util\TargetPathTrait;
 /**
  * Authenticates users against the BPN API.
  *
- * Validates credentials via BPN's getPersonalData endpoint and creates or updates
- * local User entities. Passwords are stored encrypted with RSA for subsequent API calls.
+ * The password is kept, RSA-encrypted, because every later BPN call needs it again.
  *
  * BusPro owns the whole role set and the hotel codes: both are synced on every login, in both
  * directions, so anything the CRM no longer reports is withdrawn here. What the CRM claims is
@@ -65,7 +64,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         $email = trim($request->request->getString('_username'));
         $passwordPlain = trim($request->request->getString('_password'));
 
-        // Very lame hashing applied here as required by BPN
+        // BPN requires md5, not a real hash
         $password = md5($passwordPlain);
 
         try {
@@ -179,8 +178,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         $targetPath = $this->getTargetPath($request->getSession(), $firewallName)
             ?? $this->urlGenerator->generate('app_account');
 
-        // When redirecting to admin from an HTMX request, force a full page navigation
-        // to avoid layout issues between front- (hx-boost) and backend
+        // A full load avoids hx-boost layout issues
         if ($request->headers->has('HX-Request') && str_contains($targetPath, '/admin')) {
             return new HxRedirectResponse($targetPath);
         }