better auth param checking (thanks @jerith)