Validate provisioning and authentication endpoints

Let's do this closer to the data, not deep into the callers of the
well-known parser.