diff --git a/include/grpc++/auth_metadata_processor.h b/include/grpc++/auth_metadata_processor.h
index 45030a6a45d..db4beafeffd 100644
--- a/include/grpc++/auth_metadata_processor.h
+++ b/include/grpc++/auth_metadata_processor.h
@@ -46,14 +46,17 @@ class AuthMetadataProcessor {
   virtual ~AuthMetadataProcessor() {}
 
   // If this method returns true, the Process function will be scheduled in
-  // a different thread as the one processing the call.
+  // a different thread from the one processing the call.
   virtual bool IsBlocking() const { return true; }
 
   // context is read/write: it contains the properties of the channel peer and
   // it is the job of the Process method to augment it with properties derived
   // from the passed-in auth_metadata.
+  // consumed_auth_metadata needs to be filled with metadata that has been
+  // consumed by the processor and will be removed from the call.
+  // Returns true if successful.
   virtual bool Process(
-      std::multimap<grpc::string, grpc::string>& auth_metadata,
+      const std::multimap<grpc::string, grpc::string>& auth_metadata,
       AuthContext* context,
       std::multimap<grpc::string, grpc::string>* consumed_auth_metadata) = 0;
 };
diff --git a/include/grpc++/server_credentials.h b/include/grpc++/server_credentials.h
index d540b95e219..bcc335b7d5f 100644
--- a/include/grpc++/server_credentials.h
+++ b/include/grpc++/server_credentials.h
@@ -56,7 +56,8 @@ class ServerCredentials {
   virtual int AddPortToServer(const grpc::string& addr,
                               grpc_server* server) = 0;
 
-  // Has to be called before the server is started.
+  // This method is not thread-safe and has to be called before the server is
+  // started. The last call to this function wins.
   virtual void SetAuthMetadataProcessor(
       const std::shared_ptr<AuthMetadataProcessor>& processor) = 0;
 };
diff --git a/src/cpp/server/insecure_server_credentials.cc b/src/cpp/server/insecure_server_credentials.cc
index 96458477f0e..12807e70e7a 100644
--- a/src/cpp/server/insecure_server_credentials.cc
+++ b/src/cpp/server/insecure_server_credentials.cc
@@ -34,6 +34,7 @@
 #include <grpc++/server_credentials.h>
 
 #include <grpc/grpc.h>
+#include <grpc/support/log.h>
 
 namespace grpc {
 namespace {
@@ -44,7 +45,10 @@ class InsecureServerCredentialsImpl GRPC_FINAL : public ServerCredentials {
     return grpc_server_add_insecure_http2_port(server, addr.c_str());
   }
   void SetAuthMetadataProcessor(
-      const std::shared_ptr<AuthMetadataProcessor>& processor) GRPC_OVERRIDE {}
+      const std::shared_ptr<AuthMetadataProcessor>& processor) GRPC_OVERRIDE {
+    (void)processor;
+    GPR_ASSERT(0);  // Should not be called on InsecureServerCredentials.
+  }
 };
 }  // namespace