- don't update authkeys if parse fails (done by moving that code so it runs *after* the parse) - check group/usernames for sanity