diff --git a/pdfio-crypto.c b/pdfio-crypto.c
index a5570c6..fda861a 100644
--- a/pdfio-crypto.c
+++ b/pdfio-crypto.c
@@ -434,6 +434,8 @@ _pdfio_crypto_cb_t			// O  - Decryption callback or `NULL` for none
 		own_user_key[32],	// Calculated user key
 		pdf_user_key[32];	// Decrypted user key
 
+    PDFIO_DEBUG("_pdfioCryptoMakeReader: Per-object file ID.\n");
+
     if ((id_value = pdfioArrayGetBinary(id_array, 0, &id_len)) == NULL)
     {
       *ivlen = 0;
@@ -451,6 +453,8 @@ _pdfio_crypto_cb_t			// O  - Decryption callback or `NULL` for none
 
     if (memcmp(own_user_key, pdf->user_key, sizeof(own_user_key)))
     {
+      PDFIO_DEBUG("_pdfioCryptoMakeReader: Not user password, trying owner password.\n");
+
       make_file_key(pdf->encryption, pdf->permissions, id_value, id_len, pdf->password, pdf->owner_key, temp_key);
       make_user_key(id_value, id_len, own_user_key);
 
@@ -648,6 +652,8 @@ _pdfioCryptoUnlock(
   revision = (int)pdfioDictGetNumber(encrypt_dict, "R");
   length   = (int)pdfioDictGetNumber(encrypt_dict, "Length");
 
+  PDFIO_DEBUG("_pdfioCryptoUnlock: handler=%p(%s), version=%d, revision=%d, length=%d\n", (void *)handler, handler ? handler : "(null)", version, revision, length);
+
   if (!handler || strcmp(handler, "Standard"))
   {
     _pdfioFileError(pdf, "Unsupported security handler '%s'.", handler ? handler : "(null)");
@@ -696,6 +702,8 @@ _pdfioCryptoUnlock(
     }
     else
     {
+      PDFIO_DEBUG("_pdfioCryptoUnlock: CFM=\"%s\"\n", cfm);
+
       if (length < 40 || length > 128)
 	length = 128;			// Default to 128 bits
 
diff --git a/pdfio-object.c b/pdfio-object.c
index d8b61a4..89c7835 100644
--- a/pdfio-object.c
+++ b/pdfio-object.c
@@ -453,9 +453,7 @@ _pdfioObjLoad(pdfio_obj_t *obj)		// I - Object
     return (false);
   }
 
-  PDFIO_DEBUG("_pdfioObjLoad: tb.bufptr=%p, tb.bufend=%p, tb.bufptr[0]=0x%02x, tb.bufptr[0]=0x%02x\n", tb.bufptr, tb.bufend, tb.bufptr[0], tb.bufptr[1]);
-  if (tb.bufptr && tb.bufptr < tb.bufend && (tb.bufptr[0] == 0x0d || tb.bufptr[0] == 0x0a))
-    tb.bufptr ++;			// Skip trailing CR or LF after token
+  PDFIO_DEBUG("_pdfioObjLoad: tb.bufptr=%p, tb.bufend=%p, tb.bufptr[0]=0x%02x, tb.bufptr[1]=0x%02x\n", tb.bufptr, tb.bufend, tb.bufptr[0], tb.bufptr[1]);
 
   _pdfioTokenFlush(&tb);
 
diff --git a/pdfio-token.c b/pdfio-token.c
index 652c850..65ed81b 100644
--- a/pdfio-token.c
+++ b/pdfio-token.c
@@ -447,6 +447,13 @@ _pdfioTokenRead(_pdfio_token_t *tb,	// I - Token buffer/stack
 	    return (false);
 	  }
 	}
+
+	if (ch == '\r')
+	{
+	  // Look for a trailing LF
+	  if ((ch = get_char(tb)) != EOF && ch != '\n')
+	    tb->bufptr --;
+	}
 	break;
 
     case 'N' : // number