auth/gensec: fix missleading comment