spectators: Add comments and assertions on security model.

These tweaks help make reasoning about the spectators security model
easier to understand.

zerver/views/message_fetch.py

@@ -965,6 +965,10 @@ def get_messages_backend(
         # cases of web-public queries (where we should return the
         # web-public results only) and clients with buggy
         # authentication code (where we should return an auth error).
+        #
+        # GetOldMessagesTest.test_unauthenticated_* tests ensure
+        # that we are not leaking any secure data (private messages and
+        # non web-public-stream messages) via this path.
         if not is_web_public_narrow(narrow):
             raise MissingAuthenticationError()
         assert narrow is not None