security fix: authenticating is not enough, hostname qs param (if given) also needs to match the username