Fix signedness bug in SPA authenticator