Guard against array overrun, per report from Yichen Xie. This case

can only occur if the constant DEFAULT_CLIENT_AUTHSVC is given a bogus
value, so it doesn't seem worth back-patching, but I'll fix it in HEAD.