Frame: explicitly stringify $payload in _mask() method. Otherwise if $payload looks like a number, the ^ operator is recognized as numeric XOR, not as bitstring XOR.