only change remote addr if decryption succeeds