The other calls to `MultiByteToWideChar` are the two-pass method that @phkelley mentioned. One is base64-encoded auth header stuff, and the other is constructing a URL, neither of which have a bounded length per se (and 260 characters seems a bit restrictive for those cases). I'm inclined to leave them alone.