I pushed the nasty encoding chain down into the AuthRequest class. This code was too ugly to look at.