Update chapter_18_spiking_custom_auth.asciidoc

chapter_18_spiking_custom_auth.asciidoc

@@ -555,7 +555,7 @@ We're almost there--our last step combines recognising the token
 and then actually logging the user in.
 Once we've done this,
 we'll be able to pretty much strike off all the items on our scratchpad:
-COMMENT: update scratchpad
+//SARA again it's not clear whether we're changing the scratchpad or not?  how does it correspond to what we're actually doing?  could make a little gag here.
 [role="scratchpad"]
 *****
 * _[strikethrough line-through]#How to send emails#_