String#strip raises on bytes that are not UTF-8,
so the check that should turn them away came in too late;
valid_encoding? goes first now, before strip can see the string,
and a login that is not text names nobody instead of breaking everything.

Assisted-by: Claude Opus 5 via Claude Code
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

diff --git a/lib/pro_tacts/proxy_auth.rb b/lib/pro_tacts/proxy_auth.rb
index 8386e5d..aefbea5 100644
--- a/lib/pro_tacts/proxy_auth.rb
+++ b/lib/pro_tacts/proxy_auth.rb
@@ -41,8 +41,12 @@ module ProTacts
     # down, on a group named after them.
     #: (Rack::env env) -> String?
     def self.login(env)
-      login = env[ENV_KEY].to_s.dup.force_encoding(Encoding::UTF_8).strip
-      login if login.valid_encoding? && !login.empty?
+      login = env[ENV_KEY].to_s.dup.force_encoding(Encoding::UTF_8)
+      # Checked before strip, which raises on invalid bytes.
+      return unless login.valid_encoding?
+
+      login = login.strip
+      login unless login.empty?
     end
   end
 end