re-implement spread, it's still required for rlm_yubikey