validating $auth.fieldname references (to User entity fields)