Auths: fix possible OOB read in SPA authenticator. Bug 3001