adjust comment

Signed-off-by: Ronni Skansing <rskansing@gmail.com>

backend/middleware/session.go

@@ -67,7 +67,10 @@ func handleAPISession(
 		}
 		incomingHash := sha256.Sum256([]byte(headerAPIKey))
 		found := false
-		// Must check ALL keys in constant time
+		// compare each key using constant-time comparison to avoid hash timing leaks.
+		// early exit via break is acceptable here because the key slice is derived from
+		// a go map, which randomizes iteration order on every call — an attacker cannot
+		// correlate iteration count to a stable key position across requests.
 		var rApiUser *model.APIUser
 		for _, apiUser := range apiUsers {
 			if subtle.ConstantTimeCompare(incomingHash[:], apiUser.APIKeyHash[:]) == 1 {