server/AyaNova/Controllers/PickListController.cs

@@ -81,7 +81,7 @@ namespace AyaNova.Api.Controllers
             if (PickList == null)
                 return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
 
-            //check rights
+            //RIGHTS - NOTE: uniquely to other routes this one checks the actual picklist defined roles itself
             if (!Authorized.HasAnyRole(HttpContext.Items, PickList.AllowedRoles))
                 return StatusCode(403, new ApiNotAuthorizedResponse());