auth-sources must be a quoted list.