AUTH payload is now a proper Payload() too.