dont allow truncated (incomplete) responses from auth service