We already did this, but we did it by accident, which is pretty risky: if we hadn't, then our code would have treated extra data in the inbuf as having been transmitted as TLS-authenticated data. Closes ticket 40017; Found by opara.
