and authenticated usernames were swapped.  Reported by Bryan Henderson
in bug #5386.

Also clean up poorly-maintained header comment for this function.