improve code docs in ua_accesscontrol_default.c

plugins/ua_accesscontrol_default.c

@@ -56,7 +56,11 @@ activateSession_default(const UA_NodeId *sessionId,
        &UA_TYPES[UA_TYPES_USERNAMEIDENTITYTOKEN]) {
         const UA_UserNameIdentityToken *token =
             (UA_UserNameIdentityToken*)userIdentityToken->content.decoded.data;
-        if(!UA_String_equal(&token->policyId, &username_policy) || token->encryptionAlgorithm.length > 0)
+        if(!UA_String_equal(&token->policyId, &username_policy))
+            return UA_STATUSCODE_BADIDENTITYTOKENINVALID;
+
+        /* TODO: Support encrypted username/password over unencrypted SecureChannels */
+        if(token->encryptionAlgorithm.length > 0)
             return UA_STATUSCODE_BADIDENTITYTOKENINVALID;
 
         /* Empty username and password */