protect payload stream from replay. Closes #1252