the authorization_code generator has an "encrypt" parameter that does some simple XORingthis code passes 0 for it, so that's not even turned on