auth: name the call the query-string read avoids

The token comes from RawQuery so the body reaches a proxied agent endpoint
intact. That only holds as long as nobody reaches for FormValue, which is
the obvious way to read a param and the one that drains the body, so the
comment names it.

pkg/service/auth.go

@@ -76,9 +76,8 @@ func (m *APIKeyAuthMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request,
 
 		authToken = authHeader[len(bearerPrefix):]
 	} else {
-		// the body must survive for requests proxied further (agent HTTP
-		// endpoints), so the token comes from the query string alone. URL is nil
-		// on hand-built requests.
+		// fall back to the query string rather than a form body, which must
+		// survive intact for requests proxied further (agent HTTP endpoints).
 		if r.URL != nil {
 			authToken = r.URL.Query().Get(accessTokenParam)
 		}