--- a/pkg/middleware/modifyquery.go	Tue Dec 04 17:40:10 2018 +0100
+++ b/pkg/middleware/modifyquery.go	Tue Dec 04 17:56:28 2018 +0100
@@ -62,6 +62,8 @@
 	return nil
 }
 
+// ModifyQuery creates an http.Handler which calls a modify function first before
+// calling the the nested next http.Handler.
 func ModifyQuery(next http.Handler, modify func(*http.Request, url.Values) error) http.Handler {
 
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
@@ -90,6 +92,10 @@
 	})
 }
 
+// InjectUser is a modify function fitting into ModifyQuery to inject the
+// user's name from the current session hex-encoded into the 'env' query parameter.
+// This is used by the GeoServer to restrict the access to this the user/role
+// to show show the requested map.
 func InjectUser(req *http.Request, parameters url.Values) error {
 	// To prevent SQL injections
 	parameters.Del("env")

--- a/pkg/middleware/notfound.go	Tue Dec 04 17:40:10 2018 +0100
+++ b/pkg/middleware/notfound.go	Tue Dec 04 17:56:28 2018 +0100
@@ -18,8 +18,12 @@
 	"net/http"
 )
 
+// ErrNotFound should be as the argument to panic if the NotFound should
+// report back a http.StatusNotFound.
 var ErrNotFound = errors.New("Not found")
 
+// NotFound creates an http.Handler which survives panic(ErrNotFound) and
+// reports http.StatusNotFound in these cases back to the calling handler.
 func NotFound(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 		defer func() {