Fix SPA authenticator, checking client-supplied data before using it. Bug 2571