You say it's not used, but it *is* used - we pass it to another function, which has no such comment. And that function unconditionally uses it to initialize a string (user_uri_string) - yes, I know it's sometimes overwritten, but if aor was garbage on input then the latter could crash.