[WIP] use permitted params for auth_source

see: https://www.openproject.org/work_packages/3332