mirror the request, not the encrypted content