doc some more canonicalization
add early failure in wm_authenticate if there are missing headers