strip inner auth message