PLUGIN_AUTH mystery solved: off-by-one on auth-plugin-data length