authenticateRequest() now passes hostname