fixed bug where payloads expected xor key to start with 2 extra bytes