s4-rpc: paranoid check for auth_length