The main fix here: pass the pulp authenticator to the reply consumer so it will validate incoming asynchronous replies from the agent.