note poly1305 for onetimeauth in cs3a