add validate to *auth_cancel and *auth_confirm