Docs: clarify when TLS authenticator is run