verify that the binary auth data claims to have the same size the data block actually has.

this would have been a security hole if this code was actually used ...