You're right, let is a macro so you can't pass binding forms from a variable, my mistake. But surely Scheme has some function for binding variables to the local scope...
My point is that trusting user input is the error, not having the ability to play with the scope.
Scheme has forms that add bindings to the local scope -- local defines -- but they're similar in spirit to let. There aren't any such functions in standard Scheme, and I don't know of any major implementation that has any. It's not clear how they would interact with macros or macro hygiene, and they would do unpleasant things to lexical scope which is Scheme's original schtick.
And ``let'' is? ;-)
Doing a (let [request] (check-auth ...)) would be equally dumb. Let's not blame the tools.