diff --git a/agent/agent_endpoint.go b/agent/agent_endpoint.go
index 239f962a1a..1318e8f86e 100644
--- a/agent/agent_endpoint.go
+++ b/agent/agent_endpoint.go
@@ -907,7 +907,8 @@ func (s *HTTPServer) AgentConnectCARoots(resp http.ResponseWriter, req *http.Req
 // AgentConnectCALeafCert returns the certificate bundle for a service
 // instance. This supports blocking queries to update the returned bundle.
 func (s *HTTPServer) AgentConnectCALeafCert(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
-	// Get the service ID. Note that this is the ID of a service instance.
+	// Get the service name. Note that this is the name of the sevice,
+	// not the ID of the service instance.
 	serviceName := strings.TrimPrefix(req.URL.Path, "/v1/agent/connect/ca/leaf/")
 
 	args := cachetype.ConnectCALeafRequest{
diff --git a/command/connect/proxy/proxy.go b/command/connect/proxy/proxy.go
index 96c6a75cb9..91df04025c 100644
--- a/command/connect/proxy/proxy.go
+++ b/command/connect/proxy/proxy.go
@@ -340,6 +340,8 @@ Usage: consul connect proxy [options]
   a non-Connect-aware application to use Connect.
 
   The proxy requires service:write permissions for the service it represents.
+  The token may be passed via the CLI or the CONSUL_TOKEN environment
+  variable.
 
   Consul can automatically start and manage this proxy by specifying the
   "proxy" configuration within your service definition.