  and the admin could pass auth but be passing a garbage project id that is the thing we need to validate  you suggest to create another user that would authenticate at keystone using username and password  trip validate the project id  trip i suggest to take user s token and using it validate the project id at keystone that s one less trip to keystone  one less credential to manage  one less thing to change in keystone 