core: duplicate URL array when authing so we don't mess up original