use permitted params for auth_source

see: https://www.openproject.org/work_packages/3332

ok to merge ,if tests pass :)