auth: remove stale "magic number" comment