`cipher` is leaked if we got it from here as seen in openldap's test076-authid-rewrite (just build with `-fsanitize=address` or run the first `ldapwhoami` under valgrind).