docs: add explanation section on how subclasses override functions called from the non-overridden authenticate function

[consideRatio]

The OAuthenticator.authenticate function is not supposed to be overridden, instead the subclasses are to override functions introduced in this project and called from the OAuthenticator.authenticate and check_allowed which is introduced in the Authenticator and overridden by OAuthenticator, and supposed to be overridden again by subclasses.

This section would be relevant to have if writing a tutorial on how to write a custom authenticator.

[kellyrowland]

+1, this would be really useful to have explained in the docs.