I'm suggesting using the same as I recommended in 'authenticate` which wouldn't be backward breaking. If param three isn't a hash, fall back to the old interface.