force binary encoding for blob GETs
fix buggy authentication code and add test to cover