handshake: take a copy of defaultAuthMethods before mutating