add comment documenting the fallthrough explicitly

src/Middleware/PreventAccessFromUnwantedDomains.php

@@ -35,6 +35,8 @@ class PreventAccessFromUnwantedDomains
             return $next($request);
         }
 
+        // If the route is universal, neither of these checks will pass and the logic will
+        // fall through to the $next($request) call at the end.
         if ($this->accessingTenantRouteFromCentralDomain($request, $route) || $this->accessingCentralRouteFromTenantDomain($request, $route)) {
             $abortRequest = static::$abortRequest ?? function () {
                 abort(404);